The vulnerability is an out‑of‑bounds read in ANGLE, a graphics abstraction layer used by Chrome. An attacker can craft an HTML page that triggers the read, allowing access to sensitive data residing in the browser process’s memory. This results in a confidentiality breach, as the attacker may learn information that should remain private. The weakness corresponds to CWE‑125, involving buffer access with an incorrect index.

All installations of Google Chrome that do not include the update portion 148.0.7778.216 or newer are affected. This includes every Chrome release prior to that build, across all platforms supported by Chrome’s stable channel.

Chromium rates the bug as high severity, with a CVSS score of 6.5, and an EPSS score indicating a very low exploitation probability (EPSS score < 1%). It is not listed in the CISA KEV catalog. Because the flaw can be triggered remotely from a crafted web page, the attack vector is likely Internet‑based and can affect any client that visits a malicious site. The low EPSS suggests that while the risk of exploitation exists, its operational probability is minimal.