The vulnerability is an out‑of‑bounds read in the Dawn rendering engine of Google Chrome, exposed prior to version 148.0.7778.96. A maliciously crafted HTML page can trigger the bug and allow an attacker to read memory contents that belong to another origin, thereby leaking cross‑origin data. The weakness corresponds to CWE‑125, an out‑of‑bounds read, and results in a medium‑severity information‑leak condition.

The flaw affects all desktop editions of Google Chrome that are older than 148.0.7778.96, regardless of operating system. Any user who opens a malicious page in such a browser could be compromised. No specific authentication or local privilege elevation is required beyond visiting the page.

The exploit requires only an out‑of‑bounds read triggered by a crafted page; no user interaction beyond opening the page is needed. Because the EPSS score is not available and the vulnerability is not listed in CISA KEV, the current observed exploitation risk appears low, though the medium CVSS score indicates that the impact is significant if the exploit were to succeed. Administrators should prioritize patching, as the risk outweighs the effort.