The UnacceleratedImageBufferSurface class in WebKit/Source/platform/graphics/UnacceleratedImageBufferSurface.cpp in Blink as used in Google Chrome before 48.0.2564.82 mishandles the initialization mode which allows remote attackers to obtain sensitive information from process memory via a crafted web site.