The flaw resides in the way Chrome's GPU subsystem handles certain rendering operations. An attacker who has already compromised the renderer process can load a specially crafted HTML page and cause the GPU code to leak data that should be confined to a different origin. This breach results in the exposure of confidential information from other web pages and is classified under CWE‑346, indicating missing authorization checks.

Google Chrome browsers running any version older than 151.0.7922.72 are affected. The fix is included in all releases dated 151.0.7922.72 and later, so users of the stable channel after that date have already received the remediation.

The CVSS score of 4.3 labels this vulnerability as medium severity. The EPSS score of less than 1% denotes a low likelihood of exploitation at the current time, and the flaw is not listed in the CISA KEV catalog. To exploit this issue an attacker must first compromise a renderer process, after which a maliciously crafted page can extract cross‑origin data. Because the initial compromise step is non‑trivial, the overall exploitability risk for most environments remains low. However, organizations that expose users to potentially compromised renderer processes should treat the situation as a moderate concern.