Missing authorization in the Paint component of Google Chrome (a CWE-862 weakness) enables a remote attacker to read data from a different origin by loading a specially crafted HTML page. The flaw does not escape the browser sandbox, but it bypasses the normal same‑origin policy, allowing the attacker to access and exfiltrate sensitive web content that would otherwise be protected.

All desktop editions of Google Chrome released prior to version 156.0.8078.47 are affected. The vulnerability is contained solely to the Paint component and does not impact other browser subsystems.

The CVSS score of 8.8 places this vulnerability in the high‑severity range. The EPSS score of less than 1 % indicates that exploitation is considered unlikely at present, and the issue is not listed in CISA’s KEV catalog. The likely attack vector is a crafted HTML page served from an untrusted source; exploitation generally requires a user to load the page, making user interaction a prerequisite. If successfully triggered, the attacker can read cross‑origin data within the limits of the browser sandbox, representing a privacy risk for affected users.