Uninitialized resource in GPU in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. This use‑after‑free flaw can expose sensitive data by leaking sandbox memory, limited to data leakage and not inherently providing arbitrary code execution.

The flaw affects all Google Chrome releases prior to 156.0.8078.47 on all supported operating systems. Any Chrome installation that has not received the 156.0.8078.47 patch remains vulnerable.

The CVSS score of 8.8 signals high severity. The EPSS score of < 1 % indicates a very low probability that this flaw will be exploited in the wild. The vulnerability is not recorded in the CISA KEV list, suggesting that large‑scale exploitation has not yet been observed. Based on the description, the likely attack vector is a malicious HTML page that a user visits, implying social engineering or compromised sites may be used. If exploited, the attacker could read memory from the browser sandbox, potentially exposing sensitive data that could be leveraged for further attacks.