The vulnerability is caused by uninitialized data in ANGLE, a graphics library used by Google Chrome. When a specially crafted HTML page is loaded, the browser can read portions of its own process memory, potentially disclosing sensitive data such as private user information or internal application state. This weakness is classified as CWE‑457 (improper initialization) and CWE‑824 (uninitialized data used).

Google Chrome desktop versions older than 149.0.7827.53 are affected by this flaw. Any user running those builds on a typical desktop operating system is vulnerable until the application is upgraded to a patched version.

Chromium assigns this issue a medium severity with a CVSS score of 6.5, while the EPSS score indicates a very low exploitation probability of less than 1 %. It is not listed in CISA’s KEV catalog. An attacker can obtain the vulnerability by hosting a malicious web page and delivering it to a victim’s browser, which then reads memory without requiring elevated privileges or additional malware. The potential impact is limited to information disclosure, and the low likelihood of exploitation reduces the overall risk for most environments.