The vulnerability stems from an improper implementation of the ANGLE graphics layer in Google Chrome versions prior to 151.0.7922.72. A remotely crafted HTML page can be opened in the browser, allowing the attacker to read data from the process memory. The leaked material may contain sensitive credentials or personal data, thereby exposing confidential information to an unauthorized party. The weakness is classified as CWE-200, an unintended information disclosure, and is also listed as CWE-497, reflecting that the memory contents were accessed incorrectly.

Google Chrome desktop browsers on all supported operating systems that are older than version 151.0.7922.72 are affected. These releases lack the ANGLE implementation fix that reconciles memory access controls.

The CVSS base score of 6.5 places the flaw in the moderate to high range of risk. The EPSS score of less than 1 % suggests a low probability of exploitation in the wild at this time, and the vulnerability is not listed in the CISA KEV database. Exploitation requires the victim to load a malicious HTML page, meaning the attacker typically needs user interaction or control over a web page viewed by the victim. If successful, the attacker could extract arbitrary process memory, compromising confidentiality but not necessarily integrity or availability. Overall, the risk remains moderate, with the potential impact escalating if the vulnerability is actively leveraged.