Use of an uninitialized variable in Media in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. The weakness is a CWE-457 (Uninitialized Variable). (Chromium security severity: Medium)

The vulnerability affects Google Chrome browsers. Any installation of Chrome prior to version 156.0.8078.47 is vulnerable; the known fixed version is 156.0.8078.47 and later releases are considered safe.

The CVSS score of 8.8 indicates a high severity level, and the EPSS score of less than 1% signifies that the probability of exploitation remains very low. The vulnerability is not catalogued in the CISA Known Exploited Vulnerabilities list. Attackers can potentially exploit it by hosting or injecting a malicious HTML page, and users who load such pages in the affected browser could be subject to memory disclosure within the browser’s sandbox.