The flaw is an uninitialized resource bug in the ANGLE graphics engine included in Google Chrome before version 156.0.8078.47. A maliciously crafted HTML page can trigger a use‑after‑free that lets a remote attacker read memory located outside the browser sandbox, potentially exposing private data. The weakness is classified as CWE-416 and CWE-908, both relating to memory corruption and dangling pointer use, which can compromise confinement between processes.

Affected systems include all desktop installations of Google Chrome that run the stable channel and have a version lower than 156.0.8078.47. The ANGLE module is used for rendering web content, so any system that loads the malicious page is at risk until the browser triggers the use‑after‑free. The vulnerability is specific to the browser, not to the operating system or other components.

The CVSS score of 8.8 indicates a high severity. The EPSS score is less than 1%, so widespread exploitation is currently expected to be low but not impossible. The flaw is not listed in CISA’s KEV catalog, so there is no public evidence of active exploitation yet. A likely attack vector is remote, requiring a victim to visit a specially crafted web page; once the renderer triggers the flaw, memory outside the sandbox can be read, which may allow the attacker to gather sensitive information. Until the update to 156.0.8078.47 is applied, systems remain susceptible.