An out‑of‑bounds read in the ANGLE graphics stack allows a remote attacker who has already compromised the renderer process to read sensitive data from process memory by serving a specially crafted HTML page. The flaw is a classic bounds‑checking violation (CWE‑125) that can lead to leakage of confidential information, but does not provide arbitrary code execution. This vulnerability is rated as Medium severity by Chromium.

The issue affects Google Chrome running on Windows machines when the browser version is earlier than 149.0.7827.53. The affected product is the renderer process which interacts with ANGLE to handle graphics rendering.

The exploit requires the attacker to first compromise the renderer process, so purely remote exploitation without this foothold is unlikely. The EPSS score is unavailable, and the vulnerability is not listed in the CISA KEV catalog. The lack of a public exploit, combined with the need for a compromised renderer, reduces the overall risk, but an attacker who gains renderer access could read arbitrary memory of the renderer process. The CVE is assigned a Medium severity.