The vulnerability arises from an inappropriate implementation in the Paint component of Google Chrome. A remote attacker can deliver a crafted HTML page that exploits this weakness to read data from a cross-origin source, resulting in leakage of sensitive information. The flaw is identified as CWE-346, which denotes an unnecessary disclosure of data.

Google Chrome versions earlier than 151.0.7922.72 on any platform that incorporates the Paint component are affected. Installing Chrome 151.0.7922.72 or newer addresses the issue.

The CVSS score of 4.3 characterizes this problem as Medium severity, but the EPSS score of less than 1% indicates a low probability of exploitation. This vulnerability does not appear in the CISA KEV catalog. The likely attack scenario involves a remote attacker hosting a malicious HTML page that a user visits, allowing the attacker to read cross-origin data. No special privileges or access are needed beyond the victim’s browser session, and the flaw does not provide remote code execution or denial of service.