An uninitialized memory use was discovered in the Skia graphics library that ships with Google Chrome. When a crafted HTML page is displayed, the browser may read garbage or data belonging to another origin. The attacker can therefore exfiltrate sensitive information from the victim’s browser environment. The weakness is a classic instance of Use of Uninitialized Variable (CWE‑457) and also relates to CWE‑824, both of which can lead to serious confidentiality violations.

Google Chrome browsers running any version earlier than 149.0.7827.53 are vulnerable. The issue affects all platforms that ship this Chrome version and any user who can visit a maliciously constructed web page.

Because the flaw is triggered by a web page, a remote attacker can exploit it simply by embedding the offending code in a malicious site or email attachment. Chromium's security severity is Medium, indicating the potential for cross‑origin data exposure, but the EPSS score of < 1% and the fact that the vulnerability is not listed in CISA's KEV catalog suggest that exploitation is not yet widespread. Nonetheless, the straightforward action of loading a crafted page makes the vulnerability both easy to reach and potentially impactful.