The flaw is an integer overflow in the compositing component of Chrome, enabling a remote attacker to read data from a site of a different origin when a victim visits a specially crafted page. The overflow bypasses the separation of web page contexts and permits cross‑origin data leakage.

Google Chrome versions prior to 155.0.8059.39 are vulnerable; updated releases contain the fix.

The CVSS score of 4.3 indicates a low severity level. EPSS data are not available and the vulnerability is not listed in the CISA KEV catalog. An attacker can exploit the flaw by serving a crafted web page that triggers the integer overflow in the compositing engine, enabling the victim to read data from a different origin when the page is rendered. The likely attack vector is remote: the attacker hosts the malicious page and the victim visits it.