Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker to read memory outside the sandbox… (CVE-2026-106376)

CVE-2026-106376 describes an uninitialized resource vulnerability in the ANGLE component of Google Chrome on Windows platforms before version 155.0.8059.39. This flaw enables a remote attacker to read memory outside the browser sandbox by delivering a specially crafted HTML page. The vulnerability is classified under CWE-908 (Use of Uninitialized Resource) and has a CVSS 3.1 base score of 4.7, indicating medium severity. No known exploits in the wild have been reported. The vulnerability affects versions prior to 155.0.8059.39, but no explicit affected versions were provided in the input data.

An attacker can remotely read memory outside the sandbox environment in affected versions of Google Chrome on Windows by convincing a user to visit a crafted HTML page. This could lead to partial disclosure of sensitive information from the browser's memory. The impact is limited to confidentiality (partial information disclosure) with no integrity or availability impact reported.

A fix is available in Google Chrome version 155.0.8059.39. Users and administrators should update to this version or later to remediate the vulnerability. Since this is a client software vulnerability, patching the browser is the recommended and effective mitigation. No additional vendor advisory content was provided, so check official Google Chrome security advisories for confirmation and further guidance.