An uninitialized resource within Google Chrome’s media subsystem allowed a remote attacker, via a crafted HTML page, to read cross‑origin data. The flaw represents a data confidentiality breach, making it possible for an attacker to access information from domains the victim was not supposed to see. This vulnerability leverages a weakness classified as CWE‑908, indicating improper handling of uninitialized resources. No evidence suggests denial of service or code execution; the primary consequence is the theft of confidential data.

The issue has been reported against Google Chrome, but specific affected versions are not explicitly listed in the available data. The description indicates that versions prior to 155.0.8059.39 are vulnerable, implying that later releases contain the fix. Users of Chrome should check their installation for any pending security updates and confirm they are running a patched release.

Because the exploit requires a crafted web page, the attacker must be able to supply or influence HTML content seen by the victim. The vulnerability does not imply a requirement for privileged or local access; any user visiting a malicious site could trigger it. The EPSS score is currently not available, so the exact likelihood of exploitation is unknown, but the CVSS score of 4.3, while moderate, indicates that the vulnerability still presents a non‑trivial risk. The vulnerability is not listed on the CISA KEV catalog, so it has not yet been observed in widespread traffic or as a known attack vector. Nevertheless, the combination of a moderate severity rating and potential for cross‑origin data leakage warrants immediate attention from organizations that rely on Chrome for secure browsing.