An uninitialized memory area in the video component of Google Chrome allows a remote attacker with control over the renderer process to read process memory outside the sandbox. The flaw is a classic uninitialized memory read (CWE‑908) and can lead to the exposure of arbitrary data residing in the renderer’s address space.

Google Chrome desktop versions earlier than 155.0.8059.39 on the stable channel are affected.

EPSS score is < 1% and the vulnerability is not listed in CISA’s KEV catalog. The issue is rated "High" by Chromium security. An attacker must first compromise the renderer process, which is typically achieved through a crafted HTML page that triggers the loading of the vulnerable video resource. Once the renderer is compromised, the uninitialized memory read permits the attacker to read memory beyond intended bounds, potentially exposing confidential data. This exploitation path has moderate complexity and a high potential impact due to the confidentiality breach it enables. No public exploits have been reported at the time of this analysis.