A use of an uninitialized variable in the Dawn rendering engine of Google Chrome, disclosed as a high‑severity issue by Chromium, can cause a remote attacker to read cross‑origin data through a specially crafted HTML page. The flaw does not provide arbitrary code execution, but it leaks confidential information that a victim’s browser may have accessed from another origin. The vulnerability is a classic example of CWE‑457 (Use of Uninitialized Variable).

All Chrome installations on Windows, macOS, Linux, and Chrome OS that run a version earlier than 149.0.7827.53 are affected. These include both stable channel users and any systems that have not yet applied the latest release, which begins at that version and above.

The issue is rated high in Chromium’s internal severity. No EPSS score is currently published, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the victim to open a maliciously crafted page, so it depends on user interaction or social‑engineering tactics. Given the lack of known public exploits, the exploitation likelihood is uncertain, but the potential damage of a successful data leak is significant.