In Chrome on Windows, an inappropriate implementation in ANGLE allows a remote attacker who has already compromised the renderer process to craft a malicious HTML page and provoke the renderer to expose data from another origin. The flaw represents CWE-346 (Missing Authentication for Critical Function), CWE-119 (Buffer Overread), and CWE-284 (Improper Access Control), effectively bypassing the same‑origin policy and producing a high‑severity confidential data leak as defined by Chromium's severity designation.

Google Chrome for Windows users of the stable channel older than version 148.0.7778.168 are affected. The update that mitigates the flaw is released in Chrome 148.0.7778.168 and in all subsequent stable releases.

The CVSS score is 3.1, indicating low severity. The EPSS score of < 1% shows a low probability of exploitation, and the vulnerability is not listed in CISA KEV, implying no known widespread exploitation. However, the flaw requires that the attacker already has code execution within the renderer process—a difficult precondition. Once this is achieved, cross‑origin data can be readily read, presenting a significant confidentiality risk.