Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker to read memory outside the sandbox… (CVE-2026-106202)

CVE-2026-106202 describes an uninitialized resource vulnerability in the ANGLE component of Google Chrome on Windows platforms before version 155.0.8059.39. This flaw allows a remote attacker to read memory outside the sandbox environment by delivering a specially crafted HTML page. The vulnerability is classified under CWE-908 (Use of Uninitialized Resource). The CVSS v3.1 score is 4.7, indicating medium severity, with an attack vector of network, low attack complexity, no privileges required, user interaction required, scope changed, and limited confidentiality impact.

An attacker can remotely read memory outside the sandbox in the affected Chrome versions on Windows, potentially exposing sensitive information. There is no indication of integrity or availability impact. The vulnerability requires user interaction and can be exploited via a crafted HTML page.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Users should monitor official Google Chrome security advisories for updates and apply the update to version 155.0.8059.39 or later once available.