The flaw is an out‑of‑bounds read in the ANGLE graphics engine used by Google Chrome. A malicious web page can trigger the read of memory that is not owned by the page, exposing potentially sensitive data to the attacker. The Chromium team has rated the issue as High severity based on the potential confidentiality impact.

Google Chrome desktop installations on all supported operating systems running any build prior to 148.0.7778.216 are vulnerable. These versions are present on Windows, macOS and Linux, and the regression is triggered by a crafted HTML page served over the network.

A remote attacker can exploit this weakness by hosting a malicious web page or tricking a user into opening one. The attack requires only the ability to serve or display a crafted page to the target browser; no authentication is needed. The CVSS score is 6.5, indicating a moderate severity. No public exploits or proof‑of‑concept code has been reported, and the EPSS score is < 1%. The vulnerability is not listed in CISA's KEV catalog, indicating it has not been observed in the wild at the time of reporting. The high severity rating from the Chromium project suggests that exploitation could lead to a significant confidentiality breach.