Type confusion in Skia in Google Chrome prior to 156.0.8078.47 allows a remote attacker who has compromised the renderer process to obtain cross‑origin data via a crafted HTML page. This flaw exploits a type mismatch (CWE‑843) and can lead to unauthorized data extraction, potentially allowing the attacker to read memory belonging to another origin without full sandbox escape. The vulnerability does not provide arbitrary code execution, but it enables data exfiltration if combined with other exploits or if the attacker can already influence the renderer.

Google Chrome versions earlier than 156.0.8078.47 are affected. The issue applies to all desktop builds of Chrome using the Skia renderer.

The CVSS score of 8.8 indicates high severity. EPSS data is <1%, indicating a very low probability of exploitation in the near term, and the vulnerability is not listed in CISA KEV. The attack vector is remote: a malicious web page can force the compromised renderer to read cross‑origin data; no local privilege escalation or user interaction beyond visiting the page is required.