Uninitialized GPU resources in Google Chrome versions prior to 157.0.8103.38 allow a remote attacker, once the renderer process is compromised, to read memory outside the intended sandbox via a crafted HTML page. This vulnerability can expose sensitive data that resides beyond the sandbox’s intended scope, potentially leading to disclosure of confidential information or locally‑derived secrets. The weakness is a form of improper restriction of operations within a sandbox, classified as CWE‑908.

The flaw affects the desktop editions of Google Chrome on all operating systems for which the renderer process can be loaded – Windows, macOS, and Linux – and applies to any release before 157.0.8103.38. Users of older stable releases are at risk until they upgrade to a patched build.

The vulnerability carries a high severity rating and, although no EPSS score is available, it remains noteworthy for being exploitable over the web. Attackers need only serve a maliciously crafted page to a user running an affected Chrome version; if the attacker can influence the renderer process, they can read arbitrary memory beyond the sandbox. The issue is not listed in CISA’s KEV catalog and no specific exploit tools are currently known, but the potential for data leakage warrants prompt remediation.