The flaw is a memory corruption issue in the ANGLE graphics stack used by Google Chrome, involving both a use‑after‑free and an uninitialized resource. The bug allows a remote attacker to read memory outside the sandbox via a specially crafted HTML page. This memory disclosure can compromise the confidentiality of data accessed by the user and may eventually lead to further exploitation. The underlying weaknesses are classified as CWE‑416 and CWE‑908.

Google Chrome on Windows is the only affected product. All versions prior to 156.0.8078.47 are vulnerable; later releases contain the fix. The vulnerability does not affect other operating systems according to the current information.

The CVSS score of 8.8 places this flaw in the high‑severity range. The EPSS score of < 1 % indicates that the exploitation probability is low, yet the impact is substantial if exploited. The flaw is not listed in the CISA KEV catalog, suggesting no publicly disclosed exploits yet. The likely attack vector is remote, via a malicious HTML page that the user opens or loads in the browser, rendering the vulnerability readily exploitable under typical browsing scenarios. The underlying weaknesses are memory corruption (CWE‑416) and use of an uninitialized resource (CWE‑908).