An uninitialized GPU resource in Google Chrome can be accessed after it has been freed, allowing a renderer process to read memory beyond the sandbox. The flaw is triggered by a crafted HTML page and requires that the renderer process be compromised. This use‑after‑free leads to memory disclosure, potentially revealing confidential data from the renderer process. The vulnerability is identified as CWE‑825 and CWE‑908.

Google Chrome browsers running desktop versions prior to 156.0.8078.47 are affected. Later releases that include the security patch are not vulnerable.

The CVSS score of 8.8 reflects a high severity level, whereas the EPSS score indicates a very low exploitation probability (less than 1%). The vulnerability is not listed in the CISA KEV catalog. An attacker would need to entice a user to open a crafted HTML page that triggers a use‑after‑free in Chrome’s GPU component. If successful, the attacker can read memory beyond the sandbox, potentially exposing sensitive data from the renderer process.