An integer overflow occurs in the metrics component of Google Chrome, enabling a maliciously crafted HTML page to read memory beyond the renderer sandbox. The flaw allows a remote attacker who has already compromised the renderer process to read data outside its allotted memory space, potentially exposing sensitive information or facilitating further exploitation. The weakness corresponds to CWE‑190, Integer Overflow or Wraparound.

Google Chrome versions earlier than 154.0.8037.57 are affected. The vulnerability exists in all platforms where this Chrome version runs, including desktop operating systems that use the renderer process.

The CVSS score of 3.4 indicates a low severity for the flaw, and the EPSS score is not available, suggesting limited automation in exploitation. The vulnerability is not listed in CISA’s KEV catalog, and no public exploit is known. Based on the description, it is inferred that an attacker must first have control over the renderer process, possibly through a separate compromise, before leveraging the out‑of‑bounds read. Given the attack conditions, the risk is moderate but still warrants immediate patching to prevent possible data exposure.