Insufficient validation of untrusted input in the Skia graphics library used by Google Chrome allows a remote attacker who has already managed to compromise the renderer process to leak cross‑origin data through a crafted HTML page. The flaw is an instance of CWE‑20 and CWE‑346, improper input validation, which results in a data‑exfiltration vulnerability rather than direct code execution. The attacker can obtain information that should be isolated by a same‑origin policy, potentially exposing sensitive user data.

The vulnerability affects Google Chrome browsers prior to version 149.0.7827.53. Any installation running an older major release is potentially susceptible, specifically when the renderer process can be compromised by malicious content or extensions.

The exploit requires the attacker to already gain access to the renderer process, which is normally limited by Chrome’s sandbox. Because the attack vector is not a straightforward remote code execution path, the EPSS score is < 1% and the vulnerability is not listed in CISA’s KEV catalog. Chromium classifies the risk as Medium, reflected by a CVSS score of 6.5, indicating that while the data leakage is significant, the prerequisite of renderer compromise raises the difficulty for an attacker. The lack of a publicly released exploit and the medium severity suggest a moderate but non‑immediate risk for users who keep the browser at the affected versions.