A memory corruption defect in ANGLE in Google Chrome on Windows prior to version 156.0.8078.47 permits a remote attacker to read memory outside the sandbox via a crafted HTML page. The flaw is an uninitialized resource bug (CWE‑908) that also triggers a buffer overflow (CWE‑119), resulting in remote information disclosure at the browser process level. The exposed data could include sensitive page content, enabling data exfiltration or being used in chaining attacks.

Google Chrome on Windows versions older than 156.0.8078.47. Any Windows user who runs a Chromium‑based browser prior to that build is susceptible.

The CVSS score of 8.8 denotes high severity, and the vulnerability is not listed in the KEV catalog, though the EPSS score is less than 1%. Based on the description, the likely attack vector is a remote attacker sending a crafted HTML page that triggers the overflow. The exploit requires no privileged local access and operates within the browser sandbox, resulting in memory disclosure; while it does not directly achieve code execution, it could be chained with other weaknesses to elevate impact.