An integer overflow in the Dawn graphics renderer of Google Chrome for macOS allows a remote attacker who can control a web page to access data belonging to another origin. The flaw arises when processing a specially crafted HTML document, enabling the attacker to read memory contents that should remain protected. This could expose sensitive information such as login tokens, personal data, or other confidential material that the browser holds for legitimate sites.

The vulnerability affects Google Chrome running on macOS prior to version 146.0.7680.153. Any user accessing the described crafted web page on those Chrome releases is susceptible, regardless of other operating system versions or hardware.

The CVSS score of 4.3 indicates moderate severity, and the EPSS score of less than 1% suggests a low probability of exploitation in the wild. However, the attack can be performed simply by visiting a malicious web page, making it a remote, client‑side vulnerability that does not require privileged access. The flaw is not yet listed in the CISA KEV catalog, but because the exploitation path is straightforward, users running affected versions should be advised to update promptly.