Uninitialized resource usage in the Media component of Google Chrome lets a remote attacker read memory inside the browser's sandbox by loading a specially crafted HTML page. The flaw is classified as CWE-908 and is rated medium severity by Chromium, indicating that sensitive information stored in sandboxed memory could be disclosed.

Google Chrome versions prior to 157.0.8103.38 on the desktop channel are affected. The CVE description does not list specific operating systems, so the vulnerability is presumed to impact any desktop installation of Chrome, though this inference is not directly documented in the CVE.

The EPSS score is not available and the flaw is not listed in CISA’s KEV catalog, so the probability of exploitation is uncertain. Attackers can trigger the vulnerability from any remote webpage that renders a crafted HTML payload, without needing local privileges or script execution. With a medium severity rating from Chromium and no documented exploitation, organizations should treat this as a high‑priority patch requirement until the affected versions are updated.