An out‑of‑bounds read exists in the ANGLE graphics component of Google Chrome on Windows versions prior to 153.0.8010.36. A crafted HTML page can trigger the vulnerability, allowing a remote attacker to read memory that lies outside the browser sandbox. This flaw does not provide code execution or privilege escalation, but it can leak sensitive information stored in memory, thereby compromising confidentiality.

Vulnerable systems are installations of Google Chrome on Windows that are older than the 153.0.8010.36 release. The issue is limited to the ANGLE subsystem used for rendering web content and does not affect other operating system components.

The vulnerability is classified as Low by Chromium’s security severity. No EPSS score is publicly available, and the vulnerability is not listed in the CISA KEV catalog, indicating that it is not currently demonstrated in the wild. However, because the attack can be initiated from a web page, the potential for exploitation remains unless mitigated by updating Chrome or disabling ANGLE. The risk to confidentiality, while moderate, is mitigated when the browser is patched to a version equal to or newer than 153.0.8010.36.