A flaw in ANGLE, Chrome’s graphics abstraction layer, allowed an out‑of‑bounds read that could expose sensitive data from process memory to a remote attacker. The bug, identified as CWE‑125, permits the attacker to embed a crafted HTML page in a website that, when loaded by a user with a vulnerable Chrome installation, triggers the memory leak and reveals confidential information.

The vulnerability impacts Google Chrome versions earlier than 149.0.7827.53. All users running the stable channel on any operating system who have not updated beyond this version are potentially affected.

The flaw can be exploited by a remote attacker presenting a malicious page to an unsuspecting victim; no special privileges beyond normal browsing are required. The CVSS base score of 6.5 classifies the vulnerability as Medium severity. The EPSS score of less than 1% indicates a very low likelihood of exploitation in the wild, and the vulnerability is not listed in CISA KEV. Nevertheless, the straightforward attack vector and potential to expose sensitive data in user process memory make the risk meaningful for unpatched systems.