The vulnerability arises from an uninitialized variable in the Skia graphics library used by Google Chrome on Windows. An attacker can craft a malicious HTML page that, when rendered, reads memory that was not properly zeroed, allowing the attacker to glean potentially sensitive information from the browser process. This flaw can lead to remote information disclosure with a CVSS score of 6.5.

The flaw affects Microsoft Windows users running versions of Google Chrome older than 151.0.7922.72. All builds that include the affected Skia component are susceptible until the vendor releases a patch.

The CVSS score of 6.5 indicates moderate severity, and the EPSS score of less than 1% suggests the likelihood of exploitation is low at present. It is not listed in the CISA KEV catalog. The likely attack vector is a crafted HTML page delivered over the network, which forces the vulnerable browser to read uninitialized memory. Because the flaw only allows information disclosure, the impact is limited to confidentiality loss rather than code execution or denial of service.