An uninitialized use in ANGLE, the graphics engine used by Google Chrome, allows a remote attacker who has already compromised the renderer process to read sensitive bytes from the renderer’s process memory. The flaw is triggered by loading a specially crafted HTML page and leads to potential disclosure of confidential data such as passwords, encryption keys or private session information. The vulnerability is a classic case of an uninitialized variable used in a security‑critical context, identified as CWE‑457 and CWE‑824.

All Chrome installations running a version prior to 149.0.7827.53 are affected. The flaw resides in the ANGLE component of the browser’s rendering pipeline. Users on operating systems supported by Chrome – Windows, macOS, Linux and Android – may be impacted; the specific browsers affected are those driven by the stable channel prior to the aforementioned release.

Exploit requires an attacker to already have compromised the renderer process, which is typically achieved through drive‑by attacks or malicious extensions. Once that foothold is achieved, the attacker can submit a crafted web page to trigger the uninitialized read, gaining memory contents. The CVSS score is 6.5 and the EPSS score is <1%; consequently the exploit likelihood is unknown but the severity is considered medium by Chromium as noted in the advisory. The vulnerability is not listed in the CISA KEV catalog, indicating no confirmed exploitation in the wild to date.