A flaw in the Paint component of Google Chrome prior to version 149.0.7827.53 enables a side‑channel information leak. By serving a maliciously crafted HTML page, a remote attacker can extract data from other origins that the browser processes, violating confidentiality. The weakness is classified as CWE‑1300, CWE‑203, and CWE‑205 and is considered low severity by Chromium security.

Google Chrome (stable channel) releases before 149.0.7827.53 are affected. Users running these versions on any operating system are vulnerable if they open a crafted HTML page that utilizes the Paint API.

The EPSS score is < 1% and the vulnerability is not listed in CISA’s KEV catalog, indicating no known widespread exploitation yet. However, because the attack vector is a standard web page, any user who visits a malicious site can be impacted. The CVSS score of 6.5 indicates moderate risk beyond the previously considered low severity by Chromium security, but the knowledge that sensitive data could cross origin boundaries remains significant.