An out‑of‑bounds read in the ANGLE graphics stack allows a remote attacker who has already compromised the renderer process to read sensitive data from process memory by serving a specially crafted HTML page. The flaw is a classic bounds‑checking violation (CWE‑125) that can lead to leakage of confidential information, but does not provide arbitrary code execution. This vulnerability is rated as Medium severity by Chromium.

The issue affects Google Chrome running on Windows machines when the browser version is earlier than 149.0.7827.53. The affected product is the renderer process which interacts with ANGLE to handle graphics rendering.

The CVSS score is 5.3, indicating medium severity. The exploit requires the attacker first compromise the renderer process, so purely remote exploitation without this foothold is unlikely. The EPSS score is < 1%, and it is not listed in the CISA KEV catalog. The lack of a public exploit and the need for a compromised renderer reduce overall risk, but an attacker who gains renderer access could read arbitrary memory of the renderer process.