Chromium’s ANGLE rendering engine contains an out‑of‑bounds read that can be triggered by a maliciously crafted HTML page. An attacker who has already compromised the renderer process can exploit this flaw to escape the Chromium sandbox and execute arbitrary code, compromising the confidentiality, integrity, and availability of the user’s session and any processes that the browser accesses.

Google Chrome browsers on all operating systems prior to version 153.0.8010.36 are impacted. The vulnerability exists in all desktop releases and is not limited to a particular platform.

The flaw has a CVSS score of 8.3, indicating high severity in Chromium security, and may allow a remote attacker who has already compromised the renderer process to escape the sandbox. The EPSS score is less than 1%, implying a low overall probability of exploitation, but the requirement that the attacker must first compromise the renderer process raises the exploit threshold relative to a purely remote vulnerability. The issue is not listed in CISA’s KEV catalog, but the absence of a patch means that systems remaining on vulnerable versions remain at significant risk until updated.