An insufficient bounds check in ANGLE, the graphics abstraction layer used by Google Chrome on macOS, allows a remote attacker who has already compromised the renderer process to craft an HTML page that triggers an out‑of‑bounds read. The vulnerability is identified as CWE‑125 and as a broader input‑handling weakness classified as CWE‑1286. Because the attacker can escape the renderer sandbox, the flaw can be used to execute arbitrary code or read protected memory, compromising confidentiality, integrity, and availability of the affected system.

Google Chrome running on macOS versions earlier than 151.0.7922.72 is affected. The same vulnerability applies to any Mac build of Chrome that includes the unpatched ANGLE component before this version was released.

The EPSS score of < 1% indicates a very low probability of exploitation at this time, and the vulnerability is not listed in CISA’s KEV catalog. The CVSS score of 9.6 reflects the high severity of the flaw. The attack likely requires an initial compromise that grants the attacker the ability to inject malicious content into the renderer process—such as a compromised or malicious website—after which the out‑of‑bounds read can be triggered with no additional privileges.