An uninitialized resource in the ANGLE graphics component of Google Chrome on Windows versions prior to 155.0.8059.39 allows a remote attacker to read memory outside the browser sandbox by loading a specially crafted HTML page. This flaw, classified as CWE‑908, enables an attacker to access arbitrary memory contents, representing a confidentiality breach.

Google Chrome running on Windows, for any build before 155.0.8059.39, is vulnerable. Users of older Chrome releases on Windows should be aware that the ANGLE graphics layer is affected.

Chromium rates the issue as High severity. The CVSS score of 4.7 indicates a moderate risk level for remote memory disclosure. The EPSS score is <1%, indicating a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the victim to open or load a malicious HTML page in Chrome; the attack vector is user‑initiated interaction with crafted web content. The overall risk depends on user behavior and the distribution of the malicious page, but the potential for remote memory disclosure is significant.