This vulnerability is an out-of-bounds read caused by a bad cast in the Dawn component of Google Chrome. It affects versions before 149.0.7827.53 and allows remote attackers to execute arbitrary code within the sandbox environment by delivering a specially crafted HTML page. The CVSS 3.1 vector indicates the attack can be performed remotely without privileges and requires user interaction. The impact includes high confidentiality, integrity, and availability consequences. The vendor advisory link is provided but does not explicitly state the patch or remediation level in the input data.

Successful exploitation allows remote code execution inside the sandbox, potentially compromising the confidentiality, integrity, and availability of the affected system. This could lead to unauthorized code execution in a restricted environment, which may be leveraged for further attacks or data compromise.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for current remediation guidance. Users should update Google Chrome to version 149.0.7827.53 or later once the update is available. Until then, exercise caution when visiting untrusted websites and avoid opening suspicious HTML content.