An out of bounds read in the ANGLE component of Google Chrome for Android prior to 156.0.8078.47 allows a remote attacker to read memory outside the sandbox by serving a crafted HTML page. The flaw is a boundary check failure (CWE-125) that can be exploited to access sensitive data with the privileges of the browser process. Chromium rates this vulnerability as medium severity.

Google Chrome on Android devices with a version older than 156.0.8078.47 is affected. The vulnerability exists in the ANGLE graphics layer integrated into the browser.

The CVSS score of 8.8 indicates high severity and a potentially significant impact. The EPSS score is <1% and the vulnerability is not yet listed in the CISA KEV catalog, indicating no confirmed public exploit so far. The attack vector is remote via a malicious HTML page delivered over the network. Once executed, the attacker can read memory outside the browser sandbox, potentially exposing sensitive data. No confirmed exploits have been reported in the wild.