The vulnerability is an uninitialized resource flaw in the Media subsystem of Google Chrome on Windows systems running versions earlier than 156.0.8078.47. The flaw allows a remote attacker who compromised the renderer process to potentially read memory outside the sandbox via a crafted HTML page. This could compromise the host by exposing sensitive data or enabling further exploitation. The weakness is classified as CWE‑908.

This issue affects Google Chrome on Windows platforms. All users running Chrome versions prior to 156.0.8078.47 are potentially vulnerable. The flaw is limited to the Windows desktop variant of Chrome.

The CVSS base score of 8.8 indicates high severity. The EPSS score is currently below 1%, and the vulnerability is not listed in the CISA KEV catalog. An attacker can exploit the flaw by delivering a carefully crafted HTML file that Chrome renders, triggering the uninitialized resource in Media and potentially allowing memory reads outside the sandbox. The flaw requires no user interaction beyond opening the page. While the sandbox limits direct code execution, the read access could assist an attacker in compromising the host or extracting data.