Observable discrepancy in the Paint component of Google Chrome prior to version 155.0.8059.39 permits a remote attacker to construct a crafted HTML page that triggers the paint operation. The flaw causes cross‑origin data to be disclosed to the page, allowing the attacker to read information that should be inaccessible. This results in a confidentiality breach without requiring local code execution or privileged access.

The issue affects Google Chrome browsers using the Paint API in releases before 155.0.8059.39. Systems running any earlier Chrome builds are susceptible until the specified update is applied.

The vulnerability is rated medium in Chromium’s internal severity and has a CVSS score of 4.3, indicating a moderate security impact. No EPSS score is available, suggesting that the exploitation likelihood is uncertain but not negligible. It is not listed in the CISA KEV catalog, meaning no confirmed exploitation cases yet. Although an attacker can trigger the flaw from a web page served over any network, the lack of a high CVSS score and absence of known exploitation lower the immediate threat, yet vigilance is advised for untrusted content.