Improper input validation and unchecked bounds in the ANGLE component of Google Chrome for macOS allow a remote attacker to perform an out-of-bounds read, exposing memory contents outside the sandbox through a crafted HTML page. The flaw is classified as a high‑severity input validation weakness (CWE-20) and dereference before bounds check (CWE-125), which could grant an attacker unauthorized disclosure of sensitive data within the browser process if the vulnerability is successfully abused.

Mac users running versions of Google Chrome older than 156.0.8078.47 are affected. The vulnerability exists solely in the ANGLE graphics library bundled with Chrome; no other vendors or products are identified as impacted.

The CVSS score of 8.8 denotes a high level of severity. The EPSS score is <1 % indicating a very low but non‑zero probability of exploitation. The vulnerability is not listed in the CISA KEV catalogue. Attackers would need to deliver a crafted HTML page that the user opens, such as through a malicious website or email attachment, indicating a web‑based attack vector that requires user interaction. Because the flaw allows unauthorized read of memory outside the browser sandbox, sensitive data could be leaked to the attacker without code execution or sandbox escape.