This vulnerability involves out of bounds read and write conditions in the ANGLE graphics abstraction layer within Google Chrome versions before 149.0.7827.53. Exploitation could enable a remote attacker to perform a sandbox escape via a specially crafted HTML page, potentially leading to full compromise of the browser environment. The issue is tracked as CWE-125 (Out-of-bounds Read) and CWE-787 (Out-of-bounds Write). The CVSS 3.1 base score is 9.6, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and high impact on confidentiality, integrity, and availability.

Successful exploitation could allow an attacker to escape the Chrome sandbox, potentially leading to arbitrary code execution with elevated privileges within the browser context. This could compromise user data confidentiality, integrity, and availability. No known exploits in the wild have been reported so far.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for current remediation guidance. Until an official fix is confirmed, users should exercise caution when browsing untrusted websites and consider limiting exposure to potentially malicious HTML content.