A constructed HTML page can trigger an uninitialized use of GPU resources in Google Chrome for Android, allowing a remote attacker to read memory that contains cross‑origin data. This results in a confidentiality breach rather than code execution or denial of service. The flaw is rooted in the weaknesses described by CWE‑457 (Use of Uninitialized Variable) and CWE‑824, though the specific nature of CWE‑824 is not detailed in the CVE announcement.

Google Chrome on Android devices prior to version 151.0.7922.72 is affected.

The CVSS score of 4.3 reflects a low severity assessment, and the EPSS score of less than 1% indicates a very low probability of exploitation in the near term. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires a user to load a specially crafted web page, so the attack vector is remote, web‑page‑based. Although the likelihood of exploitation remains low, the impact is the potential exfiltration of cross‑origin data from the victim’s device.