An uninitialized resource in the WebAudio component of Google Chrome allows a remote attacker, through a specially crafted HTML page, to read data from memory inside the browser sandbox. This flaw enables disclosure of potentially sensitive information that should be protected by the browser’s security boundary. The vulnerability is classified under CWE‑908, which relates to uninitialized memory usage that can leak data to adversaries. The effect is limited to information leakage; it does not directly lead to code execution or privilege escalation within the host system.

Google Chrome versions prior to 155.0.8059.39 are affected. This includes all stable channel builds of Chrome that have not yet received the 155.0.8059.39 update. Users must confirm their current build and upgrade to the patched release to eliminate the flaw.

The CVSS score is 6.5, indicating a medium level of severity. The EPSS score is <1%, suggesting a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be remote, likely triggered when a user opens a specially crafted web page that exploits the uninitialized WebAudio resource. Since the exploit requires a malicious page, the risk depends on the user's exposure to such content.