An uninitialized resource in ANGLE in Google Chrome on Windows allows a remote attacker to read memory outside the sandbox by serving a crafted HTML page. The flaw creates an uncontrolled read that can expose sensitive data residing in the memory of the renderer process, defeating browser isolation guarantees. This is a moderate‑severity flaw as it permits confidentiality compromise without the need for additional privileges.

Google Chrome on Windows platforms, specifically versions earlier than 155.0.8059.39. Any installation of Chrome on Windows that has not applied the October 2026 stable channel update is vulnerable.

The vulnerability can be exploited by delivering a malicious HTML page through the web, allowing the attacker to trigger the uninitialized read. The CVSS score of 4.7 indicates moderate severity, and the EPSS score is below 1%, suggesting a low likelihood of exploitation. The flaw is not listed in CISA KEV, but the remote nature of the attack vector and the ability to bypass sandboxing keep a notable risk for users who load untrusted content.