Google Chrome versions prior to 155.0.8059.39 contained an uninitialized resource in the Skia graphics engine that enables a remote attacker to read data from a different origin. The flaw allows an attacker to craft a malicious HTML page that, when viewed by an unsuspecting user, leaks cross‑origin data, potentially exposing sensitive information such as cookies, local storage, or other user‑specific data. The weakness is a resource manipulation (CWE-908) that results in unauthorized data exposure rather than code execution or denial of service.

The vulnerability affects all installations of Google Chrome on desktop platforms running any version of Chrome before 155.0.8059.39. Users of older Chrome releases should verify the exact version number; any version prior to the mentioned patch is impacted.

The flaw is rated Chromium security severity High. While no EPSS score is available and the vuln is not listed in the CISA KEV catalog, the impact of cross‑origin data leakage is significant for confidentiality. The likely attack vector is a remote web page containing crafted content that exploits the uninitialized Skia resource; an attacker only needs a user to visit or load the malicious page. Given the lack of a public exploit and the high severity for data leakage, the overall risk remains high as long as affected versions are in use. The CVSS score is 4.3, indicating a moderate severity level.