CVE-2026-79120: Uninitialized resource in Google Chrome

This vulnerability (CVE-2026-79120) is due to an uninitialized resource in the ANGLE graphics engine used by Google Chrome. Specifically, in versions prior to 152.0.7977.65, this flaw could be exploited by a remote attacker who crafts a malicious HTML page to potentially obtain cross-origin data, violating the same-origin policy. The issue is categorized under CWE-908 (Use of Uninitialized Resource). The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, high confidentiality impact, no integrity or availability impact.

An attacker who successfully exploits this vulnerability could gain unauthorized access to cross-origin data, potentially leading to information disclosure. The impact is limited to confidentiality, with no direct integrity or availability effects. There are no known exploits in the wild at this time.

A fix is available in Google Chrome version 152.0.7977.65. Users and administrators should update to this version or later to remediate the vulnerability. Since this is not a cloud service, patching the client software is required. No additional mitigation steps are indicated by the vendor advisory.