Uninitialized resource in the GPU of Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. The flaw involves an uninitialized GPU resource that can be exploited to access arbitrary memory, potentially exposing confidential data. The vulnerability is classified as a memory disclosure issue and is associated with CWE-908.

Google Chrome versions prior to 156.0.8078.47 on desktop are affected. The issue is fixed in the 156.0.8078.47 release and later.

The CVSS score of 8.8 denotes high severity. The EPSS score is <1%, indicating a very low probability of exploitation. The vulnerability is not listed in CISA KEV. The likely attack vector is remote via a malicious webpage that a user visits; no local exploitation prerequisites are mentioned. The flaw is an uninitialized resource in the GPU (CWE-908), making it potentially usable by attackers in the browsing context.