An out‑of‑bounds read in the Skia graphics library within Google Chrome can be triggered by a crafted HTML page, allowing a remote attacker to read and leak cross‑origin data from memory. The vulnerability is a buffer over‑read (CWE‑125) that compromises data confidentiality. There is no impact on integrity or availability beyond the information disclosure.

Google Chrome browsers running any operating system, specifically versions prior to 149.0.7827.53. The flaw exists in all standard releases that include the affected Skia code base.

The flaw carries a medium severity rating, reflected by a CVSS score of 6.5, and an EPSS score of less than 1%. It is not listed in CISA’s KEV catalog. Attackers could exploit it by hosting or convincing a victim to load a malicious web page that triggers the vulnerable Skia rendering path. No privileged access or elevated permissions are required; a typical user visiting an attacker‑controlled site would be sufficient.