The flaw is a type‑confusion vulnerability in ANGLE that can be triggered by a crafted HTML page. When ANGLE processes the page, the type mismatch allows the code to read memory beyond the intended boundary. The resulting out‑of‑bounds memory read can corrupt data structures on the stack or heap. In the worst case, an attacker could manipulate the corrupted data to trigger code execution or a denial‑of‑service. These severe consequences are inferred because the CVE description does not explicitly confirm them.

Google Chrome on Windows versions earlier than 149.0.7827.53 are affected. Any installation that uses ANGLE before that patch contains the flaw. Versions 149.0.7827.53 and newer include the fix.

The CVSS score of 8.8 indicates a high severity risk. The EPSS score is <1%, suggesting a very low likelihood of exploitation at present. The vulnerability is not listed in CISA’s KEV catalog. Attacks would likely require a user to open a maliciously crafted web page rendered by Chrome on Windows, a scenario that is plausible but depends on user behavior. The risk remains significant if an active exploit were to be developed, but current exploitation evidence is lacking.