Out of bounds read in ANGLE in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to read memory outside the sandbox via a crafted HTML… (CVE-2026-106304)

CVE-2026-106304 describes an out-of-bounds read in the ANGLE graphics abstraction layer used by Google Chrome before version 155.0.8059.39. This vulnerability permits a remote attacker to read memory outside the browser sandbox by crafting a malicious HTML page. The issue is classified under CWE-125 (Out-of-bounds Read). The CVSS v3.1 base score is 4.7 (Medium), with attack vector network, low attack complexity, no privileges required, user interaction required, scope changed, and limited confidentiality impact.

An attacker can remotely cause the browser to read memory outside its sandbox, potentially exposing sensitive information. The impact is limited to confidentiality loss; integrity and availability are not affected. There are no known exploits in the wild at this time.

A fixed version 155.0.8059.39 or later addresses this vulnerability. Users and administrators should update Google Chrome to version 155.0.8059.39 or later to remediate this issue. No additional mitigation steps are indicated.