Executive brief
Google Chrome is a widely used web browser. A vulnerability in its graphics translation engine (ANGLE) could allow a remote attacker to read sensitive information from the computer's memory. This requires the attacker to first compromise the browser's rendering process, typically by tricking a user into visiting a malicious website.
Technical details
An out-of-bounds read vulnerability (CWE-125) exists in the ANGLE (Almost Native Graphics Layer Engine) component of Google Chrome for macOS. The flaw is reachable by a remote attacker who has already achieved code execution within the sandboxed renderer process. By providing a specially crafted HTML page, the attacker can trigger an out-of-bounds memory read, potentially leading to the disclosure of sensitive information or aiding in further sandbox escape attempts. The issue was addressed in Google Chrome version 150.0.7871.47.
Affected products
- Google Chrome prior to 150.0.7871.47
Timeline
- 2026-05-13: other: Reported to Google
- 2026-06-30: patched: Fixed in version 150.0.7871.47
- 2026-06-30: disclosed