Technical impact
An instance of uninitialized use in the Skia graphics library, present in Google Chrome versions prior to 149.0.7827.53, allows an attacker to read memory that has not been properly initialized. When an attacker hosts a maliciously crafted HTML page, the uninitialized memory can be read and the data can leak to that page, violating the Same‑Origin Policy and exposing confidential information from other origins visited by the user.
Affected Systems
The vulnerability affects Google Chrome browsers with versions earlier than 149.0.7827.53 on all supported operating systems. No specific platform restrictions are documented, so any installation running the affected version is at risk.
Risk and Exploitability
The CVE has a CVSS score of 6.5, indicating medium severity, and is not listed in the CISA KEV catalog. The exploit requires only that the user open a crafted web page in the vulnerable Chrome instance; there is no requirement for elevated privileges or local access. Given the lack of a public exploit and an EPSS score of < 1%, the current likelihood of exploitation is low but could rise if the vulnerability is publicly disclosed. The primary consequence is the potential leakage of cross‑origin data, compromising confidentiality rather than integrity or availability.
Debian DSA