The vulnerability is an out-of-bounds read in the ANGLE graphics layer of Google Chrome when running on macOS before version 157.0.8103.38. This flaw allows a remote attacker, through a specially crafted HTML page, to read memory addresses outside the browser’s sandbox, potentially exposing sensitive data. The primary consequence is a confidentiality breach caused by unauthorized memory disclosure.

Affected users are those running Google Chrome on macOS versions prior to 157.0.8103.38. The problem resides in the ANGLE rendering engine and is exploitable only on macOS. All older Chrome releases released before the stated version are vulnerable.

The vulnerability is classified as high severity. The EPSS score is not available, so the current probability of exploitation is unknown, and it is not listed in the CISA KEV catalog. The likely attack vector is remote through a malicious web page that the user loads. Successful exploitation would grant an attacker read access to memory outside the sandbox, potentially revealing sensitive information. As the flaw requires only a crafted HTML page to be opened, any user visiting a compromised site could be affected, making the risk significant for all users of the vulnerable Chrome versions.