Uninitialized use within the ANGLE graphics subsystem of Google Chrome sent users exposing a memory disclosure channel. A crafted HTML page can trigger the flaw and allow a remote attacker to read potentially sensitive data from the browser’s process memory. The weakness is a classic CWE‑457 scenario where uninitialized variables lead to leakage, and the Chromium team assessed the issue as medium severity.

Google Chrome desktop browsers prior to version 149.0.7827.53 are affected. The vulnerability exists on all platforms that employ ANGLE, including Windows, macOS, and Linux. Any system running an unpatched instance of Chrome can be exploited by a malicious web page served to the user.

The EPSS score for this vulnerability is not available, and it is not listed in the CISA KEV catalog, indicating no widespread exploitation has been observed to date. The CVSS score recorded by Chromium is medium, reflecting a moderate risk level. Exploitation requires that a user visit a crafted web page; no local privilege escalation or code execution is required. However, the ability to read process memory can compromise private data and is therefore significant for an attacker with the intent to collect user information.