This vulnerability involves uninitialized use in the media component of Google Chrome versions before 149.0.7827.53. An attacker with control over the renderer process could exploit this flaw to read potentially sensitive information from process memory by delivering a specially crafted HTML page. The issue is tracked as CWE-908 (Use of Uninitialized Variable). The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, high confidentiality impact, no integrity or availability impact.

Successful exploitation could lead to unauthorized disclosure of sensitive information from the process memory of the renderer, potentially compromising user data confidentiality. There is no impact on integrity or availability. No known exploits in the wild have been reported.

The vulnerability affects versions prior to 149.0.7827.53. The vendor advisory linked indicates a stable channel update for desktop Chrome but does not explicitly confirm patch availability or remediation level. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should update to version 149.0.7827.53 or later once confirmed patched by Google.