Uninitialized use in the Skia graphics library within Google Chrome allowed a remote attacker to read data from other origins by creating a specially crafted HTML page, potentially exposing sensitive information. The flaw involves use of an uninitialized variable (CWE-457) and a related uninitialized memory usage (CWE-824). The main consequence is the theft of confidential information through cross-origin channels, without causing code execution or denial of service.

Google Chrome browsers earlier than version 151.0.7922.72 are affected. All users of these legacy Chrome releases running the Skia library are at risk.

The CVSS score of 4.3 indicates a medium severity vulnerability, while the EPSS score of less than 1% suggests a low likelihood of current exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, which further reflects its lower exploit probability. The likely attack vector is hosting or loading a malicious HTML page that leverages the uninitialized memory usage in Skia, thereby leaching cross-origin data. Successful exploitation likely requires user interaction to load the crafted content or a compromised site delivering it, inferred from the browser context.