The ANGLE graphics library in Google Chrome versions earlier than 156.0.8078.47 contains an uninitialized resource that a remote attacker can trigger through a crafted HTML page, allowing memory to be read outside the browser’s sandbox. This use‑after‑free bug enables information disclosure rather than code execution. The flaw is identified as CWE‑908 (information exposure through out‑of‑bounds read), and could expose sensitive data such as credentials or private files to an attacker who controls the malicious content.

The vulnerability affects Google Chrome browsers prior to version 156.0.8078.47 on all supported operating systems. The affected products include desktop releases of Chrome for Windows, macOS, Linux, and any other platform that ships with that build of Chrome. The patch is delivered in Chrome’s stable channel updates starting with revision 156.0.8078.47 and later.

The CVSS score of 8.8 indicates a high severity, and the EPSS score of less than 1% suggests a very low exploitation probability, meaning that while the vulnerability is severe, it is currently unlikely to be exploited. The likely attack vector is a network‑facing HTML page that a user might open or load, triggering the uninitialized resource bug upon rendering. While the flaw occurs inside the sandboxed rendering engine, the memory read occurs outside the sandbox, potentially leaking sensitive data. The vulnerability is not listed in the CISA KEV catalog, so no public exploit code is widely known, but its high severity warrants immediate mitigation.