Uninitialized Use in ANGLE, a graphics library component of Google Chrome, permits a browser to read memory that has not been properly initialized. When a malicious HTML page is loaded, the uninitialized memory can reveal sensitive data from other origins, effectively leaking cross‑origin content and compromising confidentiality. The weakness falls under CWE‑457. The vulnerability allows a remote attacker to obtain information that would otherwise be protected by the same‑origin policy, potentially exposing user data or web application state.

The flaw affects Google Chrome versions older than 149.0.7827.53, including releases in the 149.x series. Any user running one of these affected builds on Windows, macOS, or Linux is susceptible. Users of Chrome Canary or other experimental tracks that have not yet received the patch are also at risk.

The Chrome developers have classified the issue as medium severity. No public exploit code or proof‑of‑concept was reported at the time of this advisory, and the EPSS score is currently unavailable, suggesting limited exploitation likelihood. The vulnerability is not listed in the CISA KEV catalog. However, because the flaw can be triggered by a crafted web page, a determined adversary could target sandboxed users or in‑transit traffic via phishing or compromised sites. Given the absence of a known exploit, organizations should treat this as a moderate risk but still apply the official fix promptly.