The vulnerability allows a remote attacker to harvest sensitive data from the Paint component when a specially crafted HTML page is loaded in Google Chrome. By exploiting a flaw in how Paint handles certain request data, a malicious actor can read confidential information that would normally be inaccessible to regular web content. This can lead to leakage of private data such as passwords, certificates, or any data processed by the vulnerable Paint functionality, thereby compromising confidentiality. The issue exists in Google Chrome versions prior to 157.0.8103.38 on all operating systems that ship the Paint feature. Users who have not upgraded to the patched release, which includes the repair, are vulnerable. The vulnerability is specifically tied to the Paint component in the browser rather than the underlying OS. The problem is marked as Medium severity, and no EPSS score is reported, meaning the current exploitation probability is unspecified. The vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog, indicating that there is no publicly confirmed exploit yet. Nevertheless, the attack vector is remote: a malicious web page can trigger the leak from any network‑connected browser, making it a non‑local threat that can be triggered by simply viewing a web page.

Google Chrome browsers on all platforms that include the Paint component, specifically versions before 157.0.8103.38.

This information‑leak flaw can be triggered remotely by merely loading a crafted HTML page, giving an attacker the ability to read data processed by the Paint API. The Chromium security severity is Medium, and there is no publicly available EPSS score, so the exact likelihood of exploitation is uncertain. The vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed active exploits. Because the attack vector is a remote web page, the threat persists as long as users browse untrusted sites without an update.