Uninitialized Use in Codecs in Google Chrome prior to 151.0.7922.72 allows a remote attacker to obtain potentially sensitive information from process memory through a crafted HTML page. This weakness constitutes an information disclosure vulnerability, with the potential to expose confidential data residing in the browser process memory. The issue is identified by CWE-457 (Use of Uninitialized Variable) and CWE-824 (Information Exposure).

Google Chrome browser versions older than 151.0.7922.72 are affected. Users running any Chrome build before this version that lacks the planned patch are at risk.

The CVSS score of 6.5 indicates medium severity. The EPSS score of less than 1% signals a low probability of exploitation at the time of analysis, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote, exploiting a malicious or compromised web page that the victim visits while Chrome is running. An attacker would need only to host or provide a crafted HTML page that triggers the codec functionality; no privileged access or additional software is required.