This vulnerability arises from an uninitialized variable in ANGLE, a component of Google Chrome, which can lead to an attacker reading sensitive data from process memory when a specially crafted HTML page is loaded. The weakness, identified as CWE-457, enables information disclosure without requiring elevated privileges or malicious code execution. The exposure allows an attacker to obtain potentially private or confidential data that resides in the browser's memory.

The flaw affects Google Chrome versions older than 149.0.7827.53 on desktop platforms. Users running these builds are vulnerable until Chrome is updated to a version that contains the fix.

Chromium rates this bug as medium severity. No EPSS score is publicly available, and the vulnerability is not listed in CISA's KEV catalog. The likely attack vector is a remote attacker delivering a crafted HTML page to a victim's browser, resulting in a memory read. Because it does not require privilege escalation or additional malware, the potential impact remains moderate, but any compromised process memory could reveal user data or internal application state.