A memory corruption flaw exists in the ANGLE component of Google Chrome for Windows. The defect allows an attacker to create a malicious HTML page that, when opened in Chrome, triggers the corruption and results in an out‑of‑bounds read that can expose data outside the sandbox. The weakness is a classic buffer overflow (CWE‑119) and an out‑of‑bounds read (CWE‑125). The impact is limited to the sandboxed environment, but the attacker can potentially read sensitive user data or compromise browser state.

Google Chrome installed on Windows systems running versions older than 156.0.8078.47 are affected. Users of earlier stable channel releases remain at risk until they upgrade to a patched version.

The CVSS score of 8.8 signals a high severity vulnerability allowing memory disclosure. The EPSS score is reported as < 1 %, indicating a low but nonzero probability of exploitation in the wild. The flaw is not currently listed in the CISA KEV catalog. The likely attack vector is a crafted web page served over HTTP or HTTPS that the user visits, which triggers the memory corruption and exposes data outside Chrome's sandbox.