Uninitialized Use in Dawn allows a remote attacker who has compromised the Chrome renderer process to read potentially sensitive data from process memory. The flaw involves accessing memory that has not been properly initialized before use, which can expose private information to the attacker. The vulnerability is categorized as a medium severity flaw due to its impact on confidentiality when the renderer has already been compromised.

Google Chrome browsers prior to version 151.0.7922.72 are affected. The vulnerability manifests in the renderer component of the browser, affecting any installation of Chrome that has not applied the latest stable update.

The CVSS score of 6.5 indicates moderate risk. The EPSS score of less than 1% suggests that exploitation is currently unlikely, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector requires the attacker to first obtain control of the renderer process, which typically means the attacker has already compromised the user’s machine or gained access through a malicious web page. Once this condition is met, the attacker can leverage the unmanaged memory access to read data stored in Chrome’s process memory. Although the probability of exploitation is low in the wild, organizations that rely on Chrome for sensitive browsing should still consider the risk if users frequently visit untrusted sites or run web content with elevated privileges.