Google Chrome ANGLE out-of-bounds read may expose memory outside the sandbox

Out of bounds read in ANGLE in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker to potentially read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Low)

• Google Chrome on Windows: The structured record marks versions less than 153.0.8010.36 as affected.
• Google fix information: Google’s stable-channel notice identifies the Windows/Mac 153.0.8010.36/.37 builds as containing security fixes.
• The available evidence does not establish the status of other Chrome branches, other distributions, or parallel configurations outside the Windows scope stated in the record.

Google Chrome on Windows contains an out-of-bounds read in the ANGLE component, classified as CWE-125. The attacker controls a crafted HTML page, and the record states that a remote attacker may potentially cause Chrome to read memory outside the expected bounds and outside the sandbox. The described path is browser-reachable through HTML processing, but the available evidence does not identify the relevant API, data structure, trigger sequence, or required browser state. The plausible security outcome is disclosure of data from the browser process, although the type of data and repeatability are unknown. The available evidence does not establish code execution, privilege escalation, or data modification.

• Reachability: Remote, through a crafted HTML page.
• Authentication: The record does not specify an authentication requirement.
• User interaction: Chrome must process the HTML page, but the available sources do not establish whether a user must directly open it or whether additional conditions are required.
• Complexity and preconditions: The exact trigger and any additional conditions are not publicly established in the available evidence.
• Exploitation status: The supplied evidence does not establish known exploitation or a public exploit. This absence of information should not be treated as evidence that exploitation does not exist.

The technical outcome is an out-of-bounds read that may disclose data from memory outside the sandbox. Because the described path is remote and delivered through HTML, Chrome users who process malicious content may be exposed. The available evidence does not establish an authentication requirement, code execution, privilege escalation, data modification, or availability impact. The organizational consequence could be loss of confidentiality for browser-processed data, but the affected data and practical scale remain unknown.

The flaw may expose data held in the Chrome process beyond the sandbox boundary, creating a confidentiality risk for information processed by the browser. The specific data, scope of exposure, and likelihood of a real-world disclosure are not established. The available evidence does not confirm data modification, code execution, privilege escalation, service disruption, or a resulting breach. Operationally, unpatched Windows Chrome endpoints should be identified and brought into the update process.

1. Update Google Chrome on Windows using the stable-channel update containing the Windows/Mac 153.0.8010.36/.37 builds, matching the installed platform build.
2. After deployment, verify that no Windows endpoint remains on a version less than 153.0.8010.36.
3. Prioritize systems that routinely access or process untrusted HTML during the initial rollout.
4. The supplied record and Google notice do not provide a separate mitigation beyond applying the update. Do not infer measures such as disabling a browser component without vendor guidance.

• Inventory all Google Chrome installations on Windows and record the exact running version.
• Flag systems running a version less than 153.0.8010.36 for priority handling.
• Verify deployment of the stable update containing the Windows/Mac 153.0.8010.36/.37 builds.
• Reconcile browser-management compliance reports with endpoint inventory, especially for systems that process untrusted HTML.
• No specific IOC, log event, or forensic artifact is provided by the available evidence. The absence of such evidence does not demonstrate that a system is safe.