CVE-2026-79270: Uninitialized resource in Google Chrome

This vulnerability arises from an uninitialized resource in the ANGLE graphics engine used by Google Chrome. Prior to version 152.0.7977.65, a remote attacker could exploit this flaw by crafting a malicious HTML page that triggers reading of memory outside the browser's sandbox. The issue is classified as medium severity with a CVSS 3.1 base score of 6.5, indicating a network attack vector with low attack complexity, no privileges required, and user interaction needed. The impact is high confidentiality loss without integrity or availability impact. The vendor advisory confirms the fix was included in Chrome version 152.0.7977.65.

Successful exploitation allows remote attackers to read sensitive memory contents outside the sandbox, potentially exposing confidential information. There is no impact on integrity or availability. The attack requires user interaction (visiting a crafted HTML page).

A fix is available in Google Chrome version 152.0.7977.65. Users and administrators should update to this version or later to remediate the vulnerability. No additional mitigations are indicated by the vendor advisory.