Chrome users can be exposed to unintended data leakage due to an integer overflow bug in ANGLE, the graphics abstraction layer used by recent Chrome builds. An attacker can supply a specially crafted HTML page that triggers the overflow and causes the browser to read memory beyond its intended bounds. The result is that data belonging to another origin can be exposed to the attacker’s page, effectively allowing remote data exfiltration from the victim's machine.

Google Chrome versions earlier than 148.0.7778.216 are vulnerable. This includes all stable‑channel builds released before the Chrome update published in early May 2026. Any system running one of those builds on desktop platforms is potentially affected.

The vulnerability’s severity is listed as Critical by Chromium. The CVSS score of 4.3 indicates medium severity, and EPSS score of < 1% indicates a low likelihood of exploitation. The combination of a low‑effort attack vector—remote delivery via a malicious web page—and the high impact suggests a lower likelihood of exploitation compared to higher EPSS scores. There is no indication the issue is listed in CISA’s KEV catalog. The attack requires the victim to visit a crafted page, which is typical of many web‑based vulnerabilities. Because the flaw lies in a core platform component, all users who can render the malicious content are at risk.