Technical impact
An integer overflow in the ANGLE graphics subsystem of Google Chrome allows a remote attacker to cause Chrome to read memory beyond the intended bounds when rendering a specially crafted HTML page. The overflow can result in arbitrary memory disclosure, potentially exposing sensitive data loaded in the browser process. The weakness is a classic integer overflow, mapped to CWE‑472 and CWE‑190, and the Chromium security team rates the severity of the issue as medium. Based on the description, the attack vector is inferred to be remote via a crafted HTML page that the victim must load in Chrome.
Affected Systems
Google Chrome on Windows prior to version 147.0.7727.138 is affected. The vulnerability is present in all Windows builds of Chrome that have not applied the update component that fixes the ANGLE overflow. Only systems running Windows and Chrome before the stated version need remediation. This inference is drawn from the specified affected versions and vendor/product list.
Risk and Exploitability
Based on the description, the attack vector is remote and requires the victim to load a maliciously crafted web page. The exploit is client‑side and does not require network privileges beyond normal browser access. The EPSS score is 0.00011, indicating a very low probability of exploitation. The vulnerability is not currently listed in CISA’s KEV catalog. The CVSS score of 4.3 indicates that while the vulnerability does not provide direct remote code execution, it can lead to information disclosure. Once the crafted page is rendered in a user’s Chrome session, the attacker could read arbitrary memory content, potentially leaking confidential data.
Debian DSA