CVE-2026-79120: Uninitialized resource in Google Chrome

This vulnerability arises from an uninitialized resource in the ANGLE graphics abstraction layer within Google Chrome versions before 152.0.7977.65. An attacker can exploit this flaw by delivering a specially crafted HTML page that may enable them to obtain data across origins, violating the same-origin policy. The issue is classified with a medium severity and a CVSS 3.1 base score of 6.5, indicating a network attack vector with low attack complexity, no privileges required, and user interaction needed. The impact is limited to confidentiality (cross-origin data exposure) without integrity or availability effects.

Successful exploitation could lead to unauthorized disclosure of cross-origin data, potentially compromising user privacy or sensitive information accessible through the browser. There is no indication of integrity or availability impact. No known exploits are reported in the wild at this time.

A fixed version is available: Google Chrome 152.0.7977.65 addresses this vulnerability. Users and administrators should update to this version or later to mitigate the risk. The vendor advisory confirms the availability of this update. No additional mitigation steps are indicated.