The vulnerability involves an uninitialized resource in the GPU component of Google Chrome before version 156.0.8078.47. A remote attacker who has compromised the renderer process can craft an HTML page that exploits this uninitialized GPU memory to acquire cross‑origin information. This flaw is categorized as CWE‑908, indicating data leakage through an uninitialized resource.

Google Chrome desktop versions prior to 156.0.8078.47, as distributed on the stable channel, are affected. The issue is tied to the GPU driver integration within the browser and affects all operating systems that ship Chrome without the mentioned update.

The high CVSS score of 8.8 indicates a serious risk and significant exploitability. The EPSS score of < 1% suggests a very low probability of exploitation at present, and the vulnerability is not in CISA’s KEV catalog. An attacker who has already compromised the renderer process can craft a malicious HTML page that exploits an uninitialized GPU resource to read cross‑origin data. This requires the victim to open a specially designed webpage, typically via a malicious site or phishing link, making the threat remote but contingent on user interaction. Overall, the risk remains substantial due to the high impact but is mitigated by the low likelihood of exploitation and the need for user‑initiated browsing.