This vulnerability involves an uninitialized resource in the ANGLE graphics subsystem of Google Chrome on Windows versions earlier than 156.0.8078.47. A crafted HTML page can trigger the leak, potentially allowing a remote attacker to read cross‑origin data from the browser’s process memory. The flaw is an information‑disclosure issue (CWE‑200) and an uninitialized memory usage that may lead to further exploitation (CWE‑908). The disclosed data could include confidential information held by web or desktop applications running in the same process space.

Affected systems are Windows PCs that have installed Google Chrome before version 156.0.8078.47. The vulnerability does not appear in later Chrome releases and is limited to the ANGLE component that handles graphics rendering.

The Chromium project rates the issue as Medium security severity, with a CVSS score of 6.5. Because the exploit requires a crafted HTML document that the user must open, the attack vector is likely a malicious website or a local web file served by an attacker. The EPSS score is less than 1%, and the absence from the CISA KEV catalog suggests it is not currently being actively exploited. The flaw grants read access only to data accessible in the Chrome process; however, a successful exploit would still allow an attacker to compromise user privacy with relatively low effort if the user visits the malicious content.