In Google Chrome, an improper implementation in the Skia graphics library allows a remote attacker who has already compromised the renderer process to read cross‑origin data through a cleverly crafted HTML page. The flaw results in unintended exposure of information that should be isolated by the browser’s same‑origin policy, potentially revealing sensitive data to the attacker. The weakness is a classic example of Information Exposure (CWE‑200 and CWE‑346).

All Google Chrome installations running versions earlier than 148.0.7778.216 are affected. The vulnerability is present in the Skia component of the browser; therefore any machine that uses a pre‑release 148.0.7778.216 Chrome build is susceptible.

The CVSS score of 3.1 indicates low severity. The EPSS score of 0.00035 points to a very low probability of exploitation, and the lack of a CISA KEV listing suggests it is not yet widespread. The potential impact remains significant for affected sites, but the overall risk to a typical user is low to medium because the vulnerability requires prior compromise of the renderer process, and exploitation appears unlikely. Thus the risk level is consistent with the low CVSS and very low EPSS, and it is unlikely to be a widespread threat in the short term.