Uninitialized resource in ANGLE in Google Chrome on Windows prior to 156.0.8078.47 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. This flaw occurs in the ANGLE graphics translation layer and permits memory access beyond the sandbox boundary. The main consequence is the disclosure of confidential data that may reside in browser processes, as memory can be accessed from outside the protected sandbox. The weakness is reflected by classic buffer overrun (CWE‑119) and improper resource handling resulting in uninitialized memory access (CWE‑908).

Google Chrome on Windows versions older than 156.0.8078.47 is affected. Any installation that uses the default ANGLE implementation is vulnerable until the vendor releases a patch.

The CVSS score of 6.5 indicates medium severity. The EPSS score of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not currently listed in the CISA KEV catalog, and no publicly available exploit has been reported. Based on the description, the likely attack vector is remote via network by serving a malicious HTML page to the victim’s browser, which must be opened or visited to trigger the exploit.