CVE-2026-106258: Uninitialized resource in Google Chrome

This vulnerability involves an uninitialized resource in the ANGLE component of Google Chrome on Windows platforms. An attacker can exploit this flaw remotely by crafting a malicious HTML page that triggers reading of memory outside the browser's sandbox, potentially exposing sensitive information. The vulnerability is classified as high severity by Chromium security. It affects Chrome versions before 155.0.8059.39 and was publicly disclosed on October 6, 2026. Google has issued a stable channel update to fix this issue.

Successful exploitation allows a remote attacker to read memory outside the sandbox in Google Chrome on Windows, which could lead to exposure of sensitive information or data leakage. The vulnerability does not indicate code execution or privilege escalation but compromises memory confidentiality.

Google has released an official fix in Chrome version 155.0.8059.39. Users and administrators should update to this version or later to remediate the vulnerability. No additional mitigation steps are specified or required beyond applying the update.