Uninitialized use within the ANGLE graphics subsystem of Google Chrome allows a crafted HTML page to trigger the flaw and let a remote attacker read potentially sensitive data from the browser’s process memory. The weakness is identified as a CWE‑457 and CWE‑824 situation, leading to information disclosure.

Google Chrome desktop browsers prior to version 149.0.7827.53 are affected. The flaw is exposed to any user who opens a malicious web page in the browser.

The CVSS score of 6.5 denotes a medium risk level, while the EPSS score of less than 1% indicates a very low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires only that a user visit a crafted web page; no local privilege escalation or code execution is needed. The potential impact is the compromise of private data that a user may have loaded in the browser.