An out‑of‑bounds read flaw exists in the ANGLE component of Google Chrome before version 155.0.8059.39. The weakness, a classic buffer underread (CWE‑125), allows a remote attacker to read arbitrary memory beyond the browser process’s sandbox via a specially crafted HTML page. This could expose sensitive data stored in Chrome’s sandboxed environment.

The vulnerability affects all Google Chrome browsers running on any platform prior to version 155.0.8059.39. Only Chrome itself is impacted; no additional vendor or component variants are mentioned.

Chromium notes the issue as Medium severity, and the CVSS score is 4.7. It is not currently listed in the CISA KEV catalog. The EPSS score is unavailable, offering no clear insight into exploitation likelihood. The attack vector is inferred to be a remote attacker delivering a malicious HTML page that exploits the ANGLE driver; the victim must load or view the crafted page, with no additional privilege escalation required. Consequently, the risk is moderate, but prompt patching is advised to prevent potential memory disclosure.