This vulnerability is an uninitialized use in the GPU component of Google Chrome; a remote attacker who has already compromised a renderer process can read sensitive data from process memory when a crafted HTML page is loaded, and the flaw is identified as CWE-457. The impact is information disclosure that could potentially reveal confidential data to the attacker.

Google Chrome versions prior to 149.0.7827.197 are affected. This includes all stable channel releases before that build number.

The flaw is rated as high severity and has no EPSS score available, and it is not listed in the CISA KEV catalog. The likely attack vector is a remote web page that the user loads while the compromised renderer process is running; the attacker can then gather memory contents. No official workaround is provided, so the primary mitigation is to update the browser to the fixed version.