Uninitialized resource in ANGLE in Google Chrome versions prior to 156.0.8078.47 allows a remote attacker to read memory outside the browser sandbox by loading a specially crafted HTML page. This constitutes a buffer‑related flaw (CWE‑119) combined with an uninitialized resource issue (CWE‑908). The outcome is the possible disclosure of sensitive data that resides in the Chrome process memory.

All users of the Google Chrome desktop browser whose installed version is earlier than 156.0.8078.47 are affected. The vulnerability does not specify a particular operating system, so it applies to any supported desktop platform that runs Chrome.

The CVSS score of 8.8 classifies the issue as high severity. The EPSS score of less than 1 percent indicates a very low estimated probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is remote and requires only that a malicious HTML page be opened by the user; once the memory corruption occurs, the attacker can read data beyond the sandbox boundary.