An integer overflow in Chrome’s compositing engine allows a crafted web page to read memory that contains data from a different origin, violating the same‑origin policy and exposing confidential information to an attacker. This flaw can be exploited from the network without any local privileges and results in confidentiality compromise of content that should remain isolated.

Google Chrome versions earlier than 154.0.8037.97 are affected. Users running these releases are susceptible to the described data‑leak flaw.

Chromium labels the issue as high severity; the CVSS score of 4.3 indicates moderate severity. The EPSS score is <1%, suggesting low likelihood of exploitation but still feasible from any web page. The flaw is not in the CISA KEV catalog, and its exploitability remains high because any web page can trigger it.