Uninitialized memory in the ANGLE component of Google Chrome on Windows, prior to version 155.0.8059.39, can be triggered by a crafted HTML page. This flaw allows a remote attacker to read memory outside the browser sandbox, potentially exposing sensitive data. The Chromium security team labeled the severity as High.

Any Windows system running Google Chrome versions earlier than 155.0.8059.39 is affected. The limitation to the desktop stable channel and exclusion of other Chrome variants is inferred and not explicitly confirmed in the CVE description.

The EPSS score is < 1%, and the vulnerability is not listed in CISA KEV, but the CVSS score of 4.7 and the ability to trigger the exploit by opening a crafted webpage make it a moderate threat. The most likely attack vector is a malicious website that the user visits; exploitation requires the victim to open the page in Chrome, after which the attacker can read arbitrary memory.