The flaw is in an uninitialized variable within the lmza_sdk, a component of Chrome. An attacker who can provide a specially crafted file to the browser can cause the code to use a variable that has not been set, leading to a leakage of memory inside the sandbox. This represents an information‑disclosure weakness classified as CWE‑457.

Google Chrome versions earlier than 155.0.8059.79 are affected on all operating systems where Chrome runs and uses the lmza_sdk component; specific OS are not mentioned in the description but can be inferred to include any OS that launches Chrome.

The CVSS score of 4.3 indicates moderate severity, while the EPSS score of less than 1 % suggests a low likelihood of exploitation in the wild. The vulnerability is not listed in CISA KEV. Exploitation requires an attacker to supply a malicious file that triggers the uninitialized variable inside the sandbox, giving the attacker read access to protected memory but not full system compromise.