This vulnerability involves an out-of-bounds read in the Dawn component of Google Chrome on Windows platforms before version 149.0.7827.103. An attacker can exploit this flaw by delivering a specially crafted HTML page that causes Chrome to read memory outside the intended bounds, resulting in the leakage of cross-origin data. This undermines the browser's same-origin policy and could expose sensitive information from other web origins. The issue was publicly disclosed on June 8, 2026, with a Google advisory linked, but no CVSS score or explicit patch status is provided in the available data.

Successful exploitation of this vulnerability can lead to unauthorized disclosure of cross-origin data, potentially exposing sensitive information from other websites visited by the user. This compromises user privacy and security by bypassing same-origin protections in the browser. There are no reports of active exploitation in the wild as of the publication date.

The vendor advisory from Google is available but does not explicitly confirm patch availability or remediation steps. Since the affected versions are prior to 149.0.7827.103, updating to version 149.0.7827.103 or later is the most prudent action. Patch status is not yet confirmed—check the Google Chrome release blog for the latest remediation guidance. No alternative mitigations are specified by the vendor.