Technical impact
This vulnerability arises from an integer overflow in the ANGLE component of Google Chrome for Windows, allowing a remote attacker who has already gained control of the renderer process to read sensitive data from process memory through a specially crafted HTML page. The flaw permits disclosure of potentially confidential information, posing a medium severity risk to affected users.
Affected Systems
Google Chrome running on Windows systems with versions earlier than 149.0.7827.53 is susceptible. The impact is confined to the compromised renderer process, which would typically occur in the context of a user visiting a malicious web page or executing a malicious extension.
Risk and Exploitability
The exploit requires the attacker to already have control of the renderer process, implying a prior compromise or successful exploitation of another vulnerability. EPSS is < 1% and the issue is not listed in CISA KEV, suggesting limited widespread exploitation. The CVSS score of 5.3 indicates medium severity, and given the need for an attacker foothold in the renderer process, the likelihood of exploitation remains moderate. The integer overflow permits an attacker to read arbitrary memory within the renderer, resulting in potential leakage of secrets or credentials.
Debian DSA