An uninitialized resource in ANGLE, the graphics abstraction layer used by Chrome, allows a remote attacker to read memory beyond the sandbox through a crafted HTML page. The flaw triggers when the browser processes malicious content, causing an out‑of‑bounds read that can expose data stored in the renderer process. While the description does not indicate executable code, the ability to read memory outside the sandbox could reveal sensitive information or be leveraged for further privilege escalation if an attacker can influence material processed by the browser.

Google Chrome on Windows, versions prior to 156.0.8078.47. The issue affects all users of the stable channel and any applications embedding a vulnerable Chromium engine.

The CVSS score of 8.8 highlights high potential impact. An EPSS score under 1% signals a low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. The attack vector is inferred to be a remote web page delivered from an untrusted source; a user merely needs to load the malicious content to trigger the disclosure.