This vulnerability involves an out-of-bounds read in the ANGLE graphics engine used by Google Chrome. Specifically, versions prior to 149.0.7827.53 are affected. An attacker can exploit this by delivering a specially crafted HTML page that triggers the out-of-bounds read, potentially leaking sensitive information from the browser's process memory. The CVSS 3.1 vector indicates the attack requires network access, no privileges, and user interaction, with high confidentiality impact but no integrity or availability impact. The vulnerability is categorized under CWE-125 (Out-of-bounds Read).

Successful exploitation can lead to disclosure of sensitive information from Chrome's process memory, potentially compromising user data confidentiality. There is no impact on integrity or availability. No known exploits are reported in the wild, reducing immediate risk.

A fixed version is available starting with Chrome 149.0.7827.53. Users and administrators should update to this version or later to remediate the vulnerability. The vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html provides official update information. No temporary or alternative mitigations are specified.