Executive brief
A vulnerability in Google Chrome's graphics engine (ANGLE) could allow an attacker to access sensitive information from the browser's memory. This issue affects users on Windows and requires the attacker to first compromise a website's rendering process, typically by tricking a user into visiting a malicious web page. Successful exploitation could lead to the exposure of private data handled by the browser.
Technical details
An out-of-bounds read vulnerability (CWE-125) exists in the ANGLE (Almost Native Graphics Layer Engine) component of Google Chrome for Windows. The flaw is reachable via a crafted HTML page, though it requires the attacker to have already compromised the renderer process. Once these preconditions are met, the attacker can read data outside of intended memory buffers, potentially leading to the disclosure of sensitive information from the browser's process memory. Google addressed this in version 149.0.7827.53.
Affected products
- Google Chrome prior to 149.0.7827.53
Timeline
- 2026-06-02: patched: Chrome version 149.0.7827.53 released to stable channel.
- 2026-06-04: disclosed: CVE record published.