Chrome on macOS includes an uninitialized variable in its WebML component that can be triggered by a crafted HTML page to read data from the browser’s process memory. The CVE description states that a remote attacker may obtain potentially sensitive information, but it does not explicitly identify which data types might be exposed. The flaw therefore does not provide code execution or privilege escalation; it is limited to memory disclosure.

All users running Google Chrome on macOS versions earlier than 149.0.7827.53 are affected. Versions on Windows or Linux are not impacted, and later macOS releases of Chrome include the fix.

The vulnerability can be exploited remotely when a malicious web page is rendered in the browser. The CVSS score for this vulnerability is 6.5, indicating medium severity. Evasion of the attack requires the victim to visit or load the malicious content. The EPSS score is 0.00032, indicating a very low exploitation probability. The CVE is not listed in CISA KEV, indicating no publicly disclosed exploits. The attack path is straightforward for an attacker able to host or embed a malicious site, but the low EPSS suggests a lower immediate exploitation probability.