The vulnerability arises from insufficient validation of untrusted input in the ANGLE component of Google Chrome. An attacker who has already compromised the renderer process can craft an HTML page that triggers arbitrary read and write operations, potentially exposing or modifying sensitive data. Classified as CWE‑20 and CWE‑822, this flaw could compromise data confidentiality and integrity, but it does not directly allow execution of code on the victim’s machine.

All installations of Google Chrome earlier than version 148.0.7778.96 are affected. The issue exists within the ANGLE graphics library used across Chrome’s rendering pipeline.

Exploit requires a prior compromise of the renderer process, which an attacker might achieve through a malicious site or drive‑by download. The CVSS score is 4.2, indicating a medium severity. While the EPSS score is < 1%, indicating a very low exploitation probability, the vulnerability is not currently cataloged in the CISA KEV database, suggesting no known widespread exploitation. Additionally, this flaw aligns with CWE‑822, involving incorrect assumptions about trusted data. Nonetheless, once the renderer is compromised, the attacker can read or overwrite memory, making this a significant risk for confidentiality and integrity if the initial compromise occurs.