A flaw in ANGLE, Chrome’s graphics abstraction layer, allowed an out‑of‑bounds read that could expose sensitive data from process memory to a remote attacker. The bug, identified as CWE‑125, permits the attacker to embed a crafted HTML page in a website that, when loaded by a user with a vulnerable Chrome installation, triggers the memory leak and reveals confidential information.

The vulnerability impacts Google Chrome versions earlier than 149.0.7827.53. All users running the stable channel on any operating system who have not updated beyond this version are potentially affected.

The flaw can be exploited by a remote attacker presenting the malicious page to an unsuspecting victim; no special privileges are required beyond normal browsing. Chromium assigns the vulnerability a High severity. EPSS data are unavailable and the issue is not listed in CISA KEV, but the attack vector is straightforward and widely accessible, so the overall risk remains high for unpatched systems.