Use of an uninitialized variable in Chrome’s Media component creates a use‑after‑free that can expose memory inside the sandbox. The flaw is classified as CWE‑457. Based on the description, it is inferred that a malicious HTML page containing a crafted media file may trigger the flaw while decoding, potentially allowing an attacker to read memory that resides within the sandboxed renderer. The primary impact is the disclosure of internal data; the description does not confirm code execution or sandbox escape.

Google Chrome desktop releases prior to 156.0.8078.47 on all supported operating systems are vulnerable. The issue is confined to the Chromium‑based Chrome browser and does not affect other browsers.

The CVSS base score of 8.8 indicates high severity, while the EPSS score of less than 1 % indicates a low chance of exploitation. It is inferred that the attacker can trigger the flaw via a web‑based vector, delivering a malicious HTML containing a crafted media file over HTTP or HTTPS. The resulting memory read could provide information that might aid a sandbox escape, but the CVE description does not confirm further exploitation. The vulnerability is not listed in CISA’s KEV catalog. The attack does not require privileged access or user interaction beyond visiting the page, implying that the exploit could target any user with an unpatched browser.