Uninitialized Use in Media in Google Chrome on Windows allows a malicious actor who has already compromised a renderer process to read sensitive data from process memory. The flaw arises from using uninitialized data during media handling, which is classified as CWE‑457. The identified weakness could lead to leakage of confidential information, though it does not provide immediate arbitrary code execution or denial of service.

Google Chrome for Windows versions earlier than 151.0.7922.72 is affected. Users running the specified versions should update to 151.0.7922.72 or later.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score of less than 1% reflects a very low probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires a remote attacker to first gain control of a renderer process, after which a crafted HTML page can trigger the information disclosure. The attack vector is constrained to environments where renderer compromise is possible, thereby limiting widespread impact.