The flaw is an uninitialized use in the ANGLE component of Google Chrome that allows a remote attacker to expose cross‑origin data through a crafted HTML page. The vulnerability is classified as Medium severity and maps to the CWE‑457 (Use of Uninitialized Variable) and CWE‑824 (Uninitialized Data Can Be Used). An attacker can obtain sensitive information from sites the browser connects to, resulting in a confidentiality breach.

Google Chrome users running versions older than 151.0.7922.72 are affected. The issue has been identified in all releases prior to this version, regardless of build channel.

The CVSS score of 4.3 reflects a moderate risk. The EPSS score of <1% indicates a very low likelihood of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be a crafted HTML page delivered over the network, implying remote exploitation via a normal browsing session. Given the low exploitation probability and the availability of a fix in newer releases, the overall risk is modest but mitigated by updating the browser.