Uninitialized resource in Video in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to read… (CVE-2026-106273)

CVE-2026-106273 describes an uninitialized resource issue in the Video component of Google Chrome before version 155.0.8059.39. This flaw permits a remote attacker, with prior compromise of the renderer process, to read memory outside the sandbox boundaries by delivering a specially crafted HTML page. The vulnerability is rated with a CVSS v3.1 score of 4.7, indicating medium severity, and involves a confidentiality impact without integrity or availability impact.

The vulnerability allows an attacker who has already compromised the renderer process to read memory outside the sandbox, potentially exposing sensitive information. There is no indication of integrity or availability impact. Exploitation requires user interaction (UI required) and network access with low attack complexity and no privileges required.

No explicit patch or remediation information is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should update to version 155.0.8059.39 or later once available to address this issue.