This vulnerability is a memory corruption flaw (CWE-119) in the ANGLE component of Google Chrome. A remote attacker who can serve a specially crafted HTML page to a user may trigger an out‑of‑bounds read that allows the attacker to read memory inside Chrome’s sandbox. The exploit does not provide direct remote code execution, but the leverage of sandbox data could enable further attacks, such as credential theft or privilege escalation within the renderer process.

Google Chrome desktop versions earlier than 156.0.8078.73 are affected. The issue was fixed in the 156.0.8078.73 update, which removes the vulnerable ANGLE code path. Users should apply the latest stable release provided by Google.

The vulnerability is rated “High” in Chromium’s security severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalogue. The attack vector is inferred as remote via a crafted HTML page; the exact difficulty to exploit is not detailed, but any successful exploitation would lead to memory disclosure inside the sandbox, which could be leveraged for further attacks. Given the lack of exploit data, the immediate risk is moderate to high until the vendor releases a patch.