An uninitialized resource in the GPU component of Google Chrome before version 154.0.8037.57 allows a remote attacker to read memory outside the sandbox via a crafted HTML page. This is a high‑severity information‑disclosure flaw that could expose sensitive data that the browser holds, without requiring any other privileges or interaction beyond loading a malicious web page.

The issue affects all installations of Google Chrome that are older than version 154.0.8037.57. Only Chrome releases newer than that version contain the fix, so any user running an earlier stable channel is vulnerable.

The vulnerability can be triggered remotely by serving a specifically crafted HTML page to the victim. Because Chrome's GPU pipeline is used for rendering, an attacker can exploit the memory read to gain information that might be stored on the GPU or in shared memory. The CVSS score of 4.7 places the flaw in the moderate range, yet the Chromium security team rates it as high severity, indicating that exploitation is considered feasible. The EPSS score is not available, and the defect is not listed in the CISA KEV catalog.