An uninitialized use in the Dawn graphics engine of Google Chrome can expose cross‑origin data when a maliciously crafted HTML page is rendered. The flaw allows a remote attacker to read data that should be restricted, compromising confidentiality but not integrity or availability.

Google Chrome versions prior to 151.0.7922.72 are affected. Users running the stable channel older than that snapshot are at risk.

The CVSS score of 4.3 classifies the vulnerability as moderate. The EPSS score, below 1 %, indicates a very low probability of exploitation at the current time. The flaw is not listed in the CISA KEV catalog. The most likely attack vector is a remote attacker delivering a malicious web page that the victim visits, exploiting the uninitialized memory to leak data across origins.