An uninitialized variable in the Dawn engine of Google Chrome allows a remote attacker to read potentially sensitive information from the process memory when a user opens a specially crafted HTML page. The vulnerability is implemented by the renderer leading to disclosure of data that should otherwise be protected by process isolation, thereby posing a confidentiality risk to the affected user. The weakness is identified as CWE‑457: Use of Uninitialized Variable.

Google Chrome on all platforms is affected. Versions prior to 148.0.7778.96 contain the flaw; any previously installed version before this build is vulnerable. Users should verify that their Chrome installation has been updated to a version newer than 148.0.7778.96.

The exploit requires the victim to load a malicious web page, making it an information disclosure risk limited to the browser context. The CVSS score is 6.5, indicating a medium severity according to the standard scale, while the Chromium team still rates the issue as High. Because the attack vector is a user‑visiting a website, the likelihood of widespread exploitation remains uncertain; EPSS is not available and the flaw is not listed in KEV. Nevertheless, the potential to leak private memory makes this a serious disclosure that should be addressed promptly.