A flaw in the Paint component of Google Chrome prior to version 149.0.7827.53 enables a side‑channel information leak. By serving a maliciously crafted HTML page, a remote attacker can extract data from other origins that the browser processes, violating confidentiality. The weakness is classified as CWE‑1300 and is considered low severity by Chromium security.

Google Chrome (stable channel) releases before 149.0.7827.53 are affected. Users running these versions on any operating system are vulnerable if they open a crafted HTML page that utilizes the Paint API.

The EPSS score is unavailable and the vulnerability is not listed in CISA’s KEV catalog, indicating no known widespread exploitation yet. However, because the attack vector is a standard web page, any user who visits a malicious site can be impacted. The low severity rating reflects the limited impact scope relative to other Chrome flaws, but the knowledge that sensitive data could cross origin boundaries is still significant.