A flaw in Skia’s implementation in Chrome before 151.0.7922.72 allows a remote attacker who has already compromised the renderer process to leak data from another origin through a specially crafted HTML page. The vulnerability can lead to a confidentiality compromise, exposing sensitive cross‑origin information.

The issue affects Google Chrome on all platforms for versions prior to 151.0.7922.72. The problem is tied to the Chromium project’s Skia graphics library, and the fix is included in the 151.0.7922.72 update released to the Stable channel.

The CVSS score is 3.1 and the EPSS score is below 1 %, indicating a Low severity and a very low general exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to already have control of the renderer process; from that state the crafted page can access protected resources from a different origin. The risk is therefore limited to environments where a renderer compromise is possible, but any such compromise can now be leveraged for data leakage.