Uninitialized Use in Video in Google Chrome on Windows allows a remote attacker who has already compromised the renderer process to read potentially sensitive information from process memory. The vulnerability is triggered by a crafted HTML page that causes the renderer to use uninitialized memory in the video processing path. The attacker must first achieve compromise of the renderer process, which may be possible through another vulnerability or by executing malicious code. The impact is the disclosure of sensitive data that resides in the renderer process memory, potentially including user data, credentials, or other confidential information, but it does not provide direct code execution or system‑wide control.

All versions of Google Chrome on Windows prior to 149.0.7827.103 are affected. Users on any earlier Chrome build must upgrade to this version or later.

The CVSS score of 5.3 indicates moderate severity, as rated high by Chromium, but it requires a pre‑existing compromise of the renderer process to be useful. Because the EPSS score is 0.00028 (< 1%) and it is not listed in CISA KEV, the likelihood of widespread exploitation is currently low. Nevertheless, the risk to systems that have successfully compromised the renderer process remains significant.