The vulnerability is an uninitialized resource in the Skia graphics library within Google Chrome, which could allow a remote attacker to access cross‑origin data using a specially crafted HTML page. This flaw corresponds to CWE‑908, representing improper initialization leading to data leakage. The potential impact is that an attacker could read data from other origins that the browser otherwise protects, undermining confidentiality for any sensitive information loaded in the victim’s browser.

Google Chrome for desktop browsers before version 157.0.8103.38 is affected. The issue was fixed in Chrome 157.0.8103.38 and later.

The issue has a Chromium severity of Medium, and no CVSS score, EPSS or KEV data are publicly available. Because the attack vector requires a crafted HTML page to be loaded in a victim’s browser, exploitation relies on user interaction or a compromised site. The lack of EPSS data and absence from the KEV catalog suggest that exploitation is possible but not widely documented, so a moderate risk assessment applies, with emphasis on applying the official update as soon as feasible.