An uninitialized use in the ANGLE component of Google Chrome allows a remote attacker to design a crafted HTML page that causes the browser to expose data from other origins. The vulnerability permits the leakage of sensitive information across site boundaries, representing a confidentiality breach. The weakness is rooted in uninitialized variable use (CWE‑457) and improper handling of uninitialized data (CWE‑824).

All installations of Google Chrome older than version 151.0.7922.72 are affected. The issue is confined to the Chrome browser and does not extend to Chromium or other vendors. Any system running the vulnerable Chrome release, regardless of operating system, is at risk.

The CVSS base score of 4.3 indicates a moderate overall risk level, and the EPSS score of less than 1% signals a very low likelihood of exploitation in the wild. The vulnerability is not currently listed in the CISA KEV catalog. The attack is likely performed remotely by convincing a user to load a maliciously crafted web page in the vulnerable browser. Exploitation does not require local privileges and can be achieved with the typical user’s interaction with a web resource.