The flaw arises from an uninitialized resource in Skia, the graphics engine used by Google Chrome. A malicious Web page can trigger the issue by loading crafted content that causes Skia to read memory that has not been properly initialized. The result is that the attacker can obtain data that belongs to a different origin, effectively bypassing the same‑origin policy. This weakness aligns with CWE‑908, which concerns an uninitialized data usage that can lead to unintended data disclosure.

Google Chrome browsers running any version earlier than 154.0.8037.92 are affected. The vulnerability impacts all platforms where Chrome includes the Skia component, which includes Windows, macOS, Linux, and Chrome‑based mobile browsers. The issue is fixed in the 154.0.8037.92 release and later builds.

The CVSS score of 4.3 reflects a moderate overall risk; the EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Exfiltration requires an attacker to host a malicious web page and persuade a user to visit it while Chrome is open. Once the victim browses the page, the attacker can read cross‑origin data via the uninitialized Skia resource. The impact is moderate, limited to data disclosure rather than direct code execution or denial of service.