A flaw in Skia’s handling of uninitialized memory within Google Chrome allows a compromised renderer process to read confidential data that should be isolated from other web origins. The vulnerability is a classic example of information‑leakage via unchecked memory reads, identified as CWE‑457 and CWE‑824. In affected versions, an attacker could retrieve data from pages of other sites that happen to be loaded in the same process, effectively breaching confidentiality.

All users of Google Chrome running versions prior to 149.0.7827.53 are potentially affected. The issue was fixed in the stable release 149.0.7827.53, which can be obtained from the official Chrome update channel for desktop users.

The exploit requires that an attacker first gain control of the renderer process, typically through a malicious or compromised web page. The CVSS score of 6.5 indicates a moderate severity, and the EPSS score of < 1% suggests that the likelihood of widespread exploitation is low at present. The vulnerability is not listed in CISA’s KEV database, so no widespread exploitation has been reported. Nonetheless, an attacker who can hijack the renderer process can expose cross‑origin data, potentially leading to credential theft, session hijacking, or other privacy violations.