Uninitialized resource in ANGLE in Google Chrome on Windows prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. This flaw, rated CWE-20 and CWE-908, allows the attacker to leak arbitrary memory contents, potentially exposing sensitive data. The vulnerability is classified as high severity based on its CVSS score.

Google Chrome for Windows users with versions earlier than 156.0.8078.47 are affected. All other platforms and newer Chrome releases are not impacted.

The CVSS score of 9.6 indicates a critical level of risk. The EPSS score of < 1% suggests a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, yet its high severity makes it a top priority for remediation. The likely attack vector is a remote attacker delivering a crafted HTML page that a user opens in the vulnerable browser. No public exploit or proof of concept details are disclosed, but the potential impact of memory disclosure is significant if exploited.