A flaw in Chrome's WebGL implementation allowed a malicious web page to read arbitrary memory from the browser process. This flaw manifests as a buffer read error (CWE‑125) combined with an information‑disclosure weakness (CWE‑200). An attacker could use a crafted HTML page to extract sensitive data such as private application data, session tokens, or other in‑memory secrets, leading to compromise of user confidentiality. The vulnerability does not grant arbitrary code execution but can expose valuable information at the process level.

Google Chrome on Windows, macOS, Linux, and other major operating systems is affected. All versions earlier than 146.0.7680.178 are vulnerable; newer versions include the fix. The issue applies across desktop browsers on the platforms listed in the CPE data.

The CVSS score of 6.5 classifies the issue as Medium; the EPSS score of less than 1% indicates low likelihood of exploitation in the wild, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector inferred from the description is remote, requiring the victim to visit a malicious web page. Exploitation would be straightforward for an attacker with access to a victim's browsing session but does not pose a system‑wide compromise risk.