The vulnerability is an uninitialized variable use within the ANGLE graphics library in Google Chrome. This flaw can allow a remote attacker to leak cross‑origin data by loading a crafted HTML page, enabling the attacker to read information that should have been isolated by the browser's same‑origin policy. The weakness is enumerated as CWE‑457 and CWE‑824.

Affected products include Google Chrome with versions prior to 148.0.7778.216. The vulnerability exists in the ANGLE component used by Chrome on desktop platforms.

The CVSS score of 4.3 indicates low severity, though Chromium still rates it as High. A remote attacker can exploit it from a malicious web page; no authentication or local access is required. The EPSS score is < 1%, indicating a very low probability of exploitation, and the flaw is not listed in CISA’s KEV catalog, suggesting no public evidence of active exploitation. The provider’s patch is included in Chrome 148.0.7778.216 and later. The attack vector is inferred to be remote via crafted HTML, as the description states that a crafted page can trigger the data leak.