Uninitialized variable use in the ANGLE rendering engine of Google Chrome potentially exposes cross‑origin data. An attacker who can influence the renderer process, for example by loading a specially crafted page, may read information from sites that the user accesses, violating confidentiality. The weakness is a classic instance of CWE‑457, where use‑of‑uninitialized‐variable leads to undefined behavior that can be subverted for data leakage.

Google Chrome browsers running versions earlier than 149.0.7827.53 are affected. The vulnerability is present in the ANGLE component used by the renderer process.

The flaw carries a Medium severity on Chromium’s internal scoring system. No EPSS data is available and the issue is not listed in the CISA KEV catalog. Exploitation requires an attacker to already compromise the renderer process, which typically means the user has been tricked into visiting a malicious page or has had local compromise. Once the renderer is under attacker control, crafted HTML can trigger the uninitialized variable use and leak cross‑origin data. The exploit is non‑interactive but relies on user navigation to a malicious page.