The vulnerability is an uninitialized use in Chrome’s Dawn rendering engine. A crafted HTML page can trigger the browser to read data that has not been properly initialized, allowing a remote attacker to retrieve potentially sensitive information from process memory. This is a classic case of CWE-457, where the outcome is a leak of confidential data such as credentials or tokens, compromising the confidentiality of the end‑user’s machine.

Google Chrome browsers running any release prior to version 149.0.7827.53 are affected. The patch that resolves the issue is included in Chrome 149.0.7827.53 and all later stable channel releases.

The CVE is assessed as high severity. While an EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, the attack vector is a locally crafted or hosted web page that can be opened in the victim’s browser. An attacker who can force a user to view the malicious page—such as a compromised or malicious website—could read arbitrary memory contents. No special privileges are required on the victim system, making the exploit broadly feasible for an attacker who can deliver the page.