The flaw is an uninitialized use in the ANGLE component of Google Chrome that existed in all stable releases prior to version 151.0.7922.72. A remote attacker could craft a malicious HTML page that triggers the vulnerable code path and causes data from another origin to be exposed, thereby compromising confidentiality. The issue is classified as CWE‑457, indicating a use of uninitialized variables.

Google Chrome desktop users running any stable version before 151.0.7922.72 are affected. The vulnerability resides in the ANGLE graphics subsystem and applies to all platforms that ship the standard Chrome binaries that contain that component.

The CVSS score of 6.5 reflects a moderate severity but the exploitation potential is enhanced by the confidentiality impact. The EPSS score of less than 1% suggests a very low probability of current exploitation in the wild, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The likely attack vector is a remote attacker serving a crafted HTML page over the web; no elevated privileges are required. Based on the description, it is inferred that the attacker can read cross‑origin data by manipulating the uninitialized memory used by ANGLE.