An observable discrepancy in the Paint component in Google Chrome versions earlier than 157.0.8103.38 allows a remote attacker to retrieve sensitive information by serving a specially crafted HTML page. This vulnerability is classified as CWE-203, an information disclosure weakness, and the Chromium security team rates it as Medium severity, indicating that it can expose confidential data to an attacker without requiring additional privileges.

The affected product is Google Chrome across all platforms. Users of Chrome versions prior to 157.0.8103.38 are vulnerable. No specific sub‑versions or channels are listed beyond the upper bound; therefore, any installation before that update is potentially impacted.

The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. However, since the flaw can be triggered by an arbitrary HTML page, the likely attack vector is a remote web‑based exploitation scenario. With the information disclosure severity marked as Medium, the risk is moderate: an attacker could gain access to data transmitted or rendered by the browser if the user visits a malicious site. The lack of availability of tactical mitigations or publicly disclosed exploits suggests that the exploitation likelihood is not high, but the potential impact warrants prompt remediation.