Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker to read memory outside the sandbox… (CVE-2026-106258)

CVE-2026-106258 describes an uninitialized resource vulnerability in the ANGLE component of Google Chrome on Windows platforms before version 155.0.8059.39. This flaw enables a remote attacker to read memory outside the sandbox environment by using a specially crafted HTML page. The vulnerability is classified under CWE-908 (Use of Uninitialized Resource) and has a CVSS 3.1 base score of 4.7, indicating medium severity. The attack vector is network-based with low attack complexity and no privileges required, but user interaction is necessary. The impact is limited to confidentiality loss without affecting integrity or availability.

A remote attacker can exploit this vulnerability to read memory outside the sandbox in affected versions of Google Chrome on Windows. This could lead to unauthorized disclosure of information. There is no indication of impact on data integrity or system availability. No known exploits are reported in the wild at this time.

A fix is available in Google Chrome version 155.0.8059.39 and later. Users and administrators should update to this version or later to remediate the vulnerability. Since this is not a cloud service, remediation depends on applying the official patch. No additional mitigation steps are indicated.