This vulnerability involves an out-of-bounds read in the ANGLE graphics abstraction layer within Google Chrome versions before 149.0.7827.53. Exploitation requires that the attacker has already compromised the renderer process, after which they can leverage a specially crafted HTML page to read potentially sensitive data from the process memory. The issue is classified as medium severity with a CVSS 3.1 base score of 5.3, reflecting the complexity and impact of the vulnerability. No known exploits in the wild have been reported. The vendor advisory linked indicates a stable channel update addressing this issue in version 149.0.7827.53.

Successful exploitation can lead to disclosure of sensitive information from the renderer process memory. There is no impact on integrity or availability. The attacker must have prior control over the renderer process, limiting the scope of exploitation.

A fix is available in Google Chrome version 149.0.7827.53. Users and administrators should update to this version or later to remediate the vulnerability. Since this is not a cloud service, remediation depends on applying the update to affected installations. Refer to the official Google Chrome stable channel update advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for details.