Uninitialized resource in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially obtain cross‑origin data via a crafted HTML page. The issue is rated medium severity by Chromium security and does not provide direct code execution, but permits sensitive information extraction from the browser process. Root cause involves an uninitialized resource (CWE-908) and implicit buffer over‑read behavior (CWE-119).

All installations of Google Chrome older than version 156.0.8078.47 on any supported operating system—Windows, macOS, Linux, and others—are affected. Users who have not upgraded beyond the specified release are at risk.

The EPSS score is reported as less than 1%, indicating a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The CVSS score of 4.3 indicates a low severity rating, reflecting the potential confidentiality impact of reading memory via a malicious web page. The likely attack vector is the delivery of a crafted web page to a user’s browser, requiring no special privileges beyond normal browsing. Though the risk is lower than that of a remote code execution exploit, the opportunity for data leakage remains significant.