A flaw in Skia’s handling of uninitialized memory within Google Chrome allows a compromised renderer process to read confidential data that should be isolated from other web origins. The vulnerability is a classic example of information‑leakage via unchecked memory reads, identified as CWE‑457. In affected versions, an attacker could retrieve data from pages of other sites that happen to be loaded in the same process, effectively breaching confidentiality.

All users of Google Chrome running versions prior to 149.0.7827.53 are potentially affected. The issue was fixed in the stable release 149.0.7827.53, which can be obtained from the official Chrome update channel for desktop users.

The exploit requires that an attacker first gain control of the renderer process, typically through a malicious or compromised web page. Because the EPSS score is not available and the CVSS score is not published, the quantitative likelihood of exploitation remains undefined. The vulnerability is not yet listed in CISA’s KEV database, so no widespread exploitation has been reported. Nonetheless, an attacker who can hijack the renderer process can expose cross‑origin data, which could lead to credential theft, session hijacking, or other privacy violations.