An object lifecycle flaw in Chrome’s Dawn rendering engine allows a maliciously crafted web page to read sensitive data from the browser’s process memory. The vulnerability is a memory disclosure issue that would let a remote attacker gain access to potentially confidential information without the need for advanced privileges. Severity is assessed as medium, suggesting a significant but not critical impact on confidentiality if exploited.

Google Chrome versions earlier than 148.0.7778.168 are vulnerable. The issue arises in the Dawn component used by Chrome’s rendering pipeline.

The exploit can be triggered from any remote web page, so the attack vector is remote. The EPSS score of <1% indicates a very low probability of exploitation in the wild. No active exploits are publicly documented. The vulnerability is not listed in the CISA KEV catalog. Given the medium severity and the remote nature of the vulnerability, organizations with unpatched browsers should consider this a priority to mitigate.