A flaw in ANGLE within Google Chrome on Windows allows a remote attacker to read potentially sensitive data from the process memory when loading a crafted HTML page. The issue arises from an uninitialized variable use, enabling the retrieval of confidential information without direct authentication. The vulnerability is categorized as CWE-457 and CWE-824.

Google Chrome for Windows versions prior to 151.0.7922.72 are affected. No other vendors or products are listed for this vulnerability.

The CVSS score of 4.3 indicates medium severity, while the EPSS score of less than 1% suggests low exploitation likelihood. The vulnerability is not listed in the CISA KEV catalog. Attackers could exploit the flaw by delivering a specially crafted HTML page to a victim’s Chrome browser, typically via email, a website, or a malicious link. Successful exploitation would allow the attacker to read memory content, potentially exposing sensitive information such as credentials or private data held in the browser process.