An integer overflow in the ANGLE graphics component of Google Chrome allows a remote attacker to leak cross‑origin data through a crafted HTML page. The flaw is a classic signed integer overflow (CWE-190) coupled with improper error handling (CWE-472), and it triggers when the browser parses specific ANGLE paths. Because the bug occurs within the rendering engine, the attacker can retrieve sensitive information that should be protected by same‑origin policies.

Google Chrome versions before 148.0.7778.216 are affected. Users running any of the earlier releases are susceptible when viewing malicious web pages that exercise the ANGLE code path.

The attack can be launched remotely without any prior authentication; a simple, malicious HTML page can trigger the overflow. Inferred from the description, the vulnerability is exploitable by loading such a page into the browser, so an attacker only needs the victim to visit it. The EPSS score indicates a very low probability of exploitation, but the CVSS score of 4.3 denotes medium severity. The bug is not listed in the CISA KEV catalog, suggesting no widespread exploitation yet.