The vulnerability is an out-of-bounds read and write inside the ANGLE graphics subsystem of Google Chrome. This flaw can allow a sandbox escape if the renderer process has already been compromised, enabling the attacker to execute code outside the renderer’s confined environment. It exemplifies a classic failure to enforce bounds on memory accesses, identified as CWE‑787.

All Google Chrome releases prior to build 150.0.7871.47 on desktop platforms that use ANGLE are affected. The stable channel update reference indicates the issue was fixed in the 150.0.7871.47 release and later.

The CVSS base score of 9.6 reflects high severity, but the EPSS score of less than 1% indicates that known exploitation attempts are currently rare. The vulnerability is not included in the CISA KEV catalog. An exploiter would need to first gain a foothold in the renderer process, typically via another flaw or by tricking the user into loading malicious content, and then deliver a specifically crafted HTML page to trigger the memory corruption. While the potential impact is serious, the overall risk remains moderate in environments where the renderer is not easily compromised.