An uninitialized resource in Chrome’s video subsystem before version 155.0.8059.39 enables a remote attacker to read memory within the sandbox using a crafted HTML page. The flaw is a type of memory disclosure vulnerability (CWE-908), allowing the attacker to gain confidential information that resides inside the browser’s sandboxed environment. The consequence is a breach of confidentiality for data that may be processed or displayed by the browser, although no impact on system integrity or availability is indicated.

The affected product is Google Chrome, all releases older than 155.0.8059.39. Users running earlier versions of Chrome on any platform are susceptible to the vulnerability if they visit a maliciously crafted webpage.

The vulnerability is classified as medium severity by Chromium, and the CVSS score is 6.5. EPSS score is < 1% and the flaw is not listed in the CISA KEV catalog. The attack vector is likely a user-initiated visit to a malicious webpage; no elevated privileges or network exploits are required. Given the available scores, the risk level is moderate, but because the memory content can be arbitrary, a patch is recommended.