Google Chrome (Chromium) is affected by a memory-safety issue classified as an “Uninitialized Use” (CWE-457). In versions prior to 148.0.7778.96, a remote attacker could use a crafted HTML page to read potentially sensitive information from process memory. The issue is described by Google as a Chromium security “High” severity problem.
Technically, this is an uninitialized memory use condition: some code path in the browser uses data that was not properly initialized before it is consumed. The NVD description indicates the attacker’s control comes from supplying a crafted HTML page, which can trigger the vulnerable code path and cause the browser to expose memory contents. The provided references do not include additional implementation details (e.g., specific functions/components or a concrete exploitation mechanism beyond “obtain potentially sensitive information from process memory”).
Impact: An attacker can potentially obtain sensitive information from the browser process memory by convincing a victim to load a malicious HTML page. This is an information disclosure risk rather than direct code execution, and the blast radius is primarily limited to what can be inferred from the exposed memory within the browser process context. The NVD notes “Chromium security severity: High,” but no CVSS score/vector is provided in the input, so quantitative severity cannot be derived here.
Mitigation: Update Google Chrome to version 148.0.7778.96 or later (the issue is stated as affecting “prior to 148.0.7778.96”). No workarounds, configuration changes, or detection guidance are present in the provided reference content. After updating, the vulnerable uninitialized-use condition should be resolved by the upstream fix included in the stable channel release.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CWE-457