An uninitialized GPU resource in Google Chrome before version 154.0.8037.57 allows a remote attacker who has already compromised the renderer process to read memory outside the sandbox by loading a crafted HTML page. The flaw is a CWE‑908 vulnerability, a type of improper initialization that permits memory disclosure rather than code execution.

All desktop installations of Google Chrome running a version older than 154.0.8037.57 are affected. The vulnerability resides in the Chrome renderer component that interacts with the GPU.

The CVE is rated low severity, as indicated by a CVSS score of 3.4. No EPSS score is available and the flaw is not listed in the CISA KEV catalog, indicating it is not currently known to be actively exploited in the wild. The likelihood of exploitation requires an attacker to first compromise the renderer process, which typically occurs via malicious web content or a separate privilege escalation. Once the renderer is compromised, the attacker can read arbitrary memory, potentially exposing sensitive information stored by the browser or other processes.