An uninitialized resource in ANGLE, the graphics layer used by Chrome, allows a remote attacker to read memory outside the renderer sandbox through a crafted HTML page. This can lead to disclosure of sensitive data that should otherwise remain confined to the browser process. The flaw results from improper initialization of a graphics resource, classified as CWE-908.

The flaw exists in Chrome for Windows versions prior to 155.0.8059.39. Any machine running these builds of Chrome on Windows is vulnerable if it can load malicious web content crafted by an attacker.

Chromium rates the issue as high severity. Exploitation requires only a malicious web page that the user visits, making the attack vector remote and straightforward for an adversary. The EPSS score is below 1%, and the vulnerability is not listed in CISA's KEV catalogue, but the high severity and ease of exploitation mean a significant risk for affected installations.