The vulnerability is an out‑of‑bounds read in the ANGLE graphics subsystem of Google Chrome on Windows for versions before 153.0.8010.36. This flaw allows a remote attacker to read memory located outside the browser sandbox when a malicious HTML document is loaded. While the flaw does not provide code execution or privilege escalation, it can leak sensitive data from memory, thereby compromising confidentiality.

Google Chrome installations on Windows older than build 153.0.8010.36 are vulnerable. The issue is confined to the ANGLE rendering path and does not affect other operating system components or other browsers.

The CVSS base score of 4.7 classifies this as low severity, and the EPSS score of less than 1% indicates a very low probability that it will be actively exploited. The CVE is not listed in the CISA KEV catalog, meaning no publicly known exploits exist at this time. Although the flaw is restricted to memory disclosure and does not lead to arbitrary code execution, the exposure of potentially sensitive information could aid other attacks or compromise user confidentiality. Updating to Chrome 153.0.8010.36 or newer removes the flaw, and until then users can mitigate the risk by disabling ANGLE with the "--disable-angle" flag, though this may degrade graphics performance.