The vulnerability is an uninitialized memory read exposed by Chrome’s Dawn engine. A specially crafted HTML page can cause the browser to read uninitialized contents from process memory. The bug falls under CWE‑457 and CWE‑824, and an attacker can obtain potentially sensitive data such as credentials, cookies, or other secrets, resulting in a leakage of confidential user information.

Google Chrome browsers with any release before 149.0.7827.53 are vulnerable. The fix is delivered in Chrome version 149.0.7827.53 and all subsequent stable channel releases.

The CVSS score is 6.5, indicating medium severity, while the EPSS score is less than 1 % and the issue is not listed in CISA’s KEV catalog. The attack vector is inferred to be a crafted or malicious web page that the victim opens in the browser; no local privilege escalation or system compromise is required. An attacker with access to a site that can host malicious content can entice a user to visit and trigger the read, allowing arbitrary memory disclosure.