A defect in the Paint component of Google Chrome, present in releases prior to version 155.0.8059.39, enables a remote attacker to cause the browser to expose sensitive data through a specially crafted HTML page. The flaw is classified with Chromium severity medium and relies on the attacker’s ability to supply malicious content to the browsing context.

Google Chrome users running any version older than 155.0.8059.39 are impacted. The issue specifically targets the Paint feature embedded in the browser; no other browsers or applications are affected.

The vulnerability allows an attacker to retrieve confidential information without needing elevated privileges, and the CVSS score of 4.3 indicates a medium confidentiality impact. Because the EPSS score is not available and the issue is not listed in the CISA KEV catalog, the current exploitation probability is uncertain but the possibility of remote exploitation via crafted web content means that the risk should be considered significant for exposed systems.