An incomplete cleanup routine within the V8 JavaScript engine in Google Chrome versions prior to 157.0.8103.38 allows a local attacker to read arbitrary memory through a local program. The flaw is classified as an unexpected use of uninitialized data, which means the attacker can glean sensitive information that resides in memory after an object is supposedly disposed. The impact is a local disclosure of memory contents that could potentially expose private data or aid in further attacks if combined with other vulnerabilities. This constitutes a medium‑severity weakness in Chromium because it requires the attacker to already have the ability to run code locally on the affected machine.

The vulnerability affects Google Chrome on all platforms that include the V8 engine and run versions older than 157.0.8103.38. The vendor product is Google Chrome; no further sub‑product or platform qualifiers are listed. Users are advised to verify which Chrome build they are running before addressing the issue.

Because the exploitation requires a local attacker with the ability to execute a program on the target system, the overall risk is moderated by the need for lateral access or user interaction. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, the precise read of arbitrary memory could facilitate a chain of exploits on systems that run potentially untrusted software locally. The lack of a publicly noted CVSS score suggests that the risk has not been quantified, but the nature of the flaw—uninitialized data read—indicates that any successful exploitation could lead to sensitive data exposure. Attackers would need to identify a targeted memory region, so the exact scope of the data that can be exfiltrated may depend on the local context and the state of the application.