An integer overflow in the ANGLE graphics library of Google Chrome on Windows versions older than 156.0.8078.47 allows a remote attacker to read memory outside the browser sandbox by serving a specially crafted HTML page. This flaw is a classic buffer overflow (CWE‑119) coupled with an integer overflow (CWE‑190), causing memory corruption that exposes internal state. The result is a high‑severity information disclosure that does not lead to denial of service or arbitrary code execution.

The issue exists in Google Chrome for Windows on all versions older than 156.0.8078.47. Only the Windows build is affected, and all other platform builds are not mentioned as vulnerable.

The CVSS score is 6.5, and the EPSS score is < 1 %. The vulnerability is not listed in CISA’s KEV catalog. Because the flaw can be triggered from a remote web resource, an attacker only needs to host a malicious HTML page on an untrusted site or lure a victim into clicking a link. The exploit path is straightforward for a skilled adversary and would allow memory disclosure within the sandbox without requiring privileged escalation. Although the EPSS score suggests a very low exploitation probability, the impact warrants prompt action.