The vulnerability is an uninitialized use in Skia within Google Chrome versions prior to 151.0.7922.109. If a remote attacker has already compromised the renderer process, they can craft an HTML page that causes Skia to leak data that belongs to a different origin, resulting in an information disclosure. This flaw is a CWE‑457 uninitialized variable usage and is rated high by Chromium security.

Google Chrome browsers running any version before 151.0.7922.109 are affected. The issue was fixed in the release corresponding to version 151.0.7922.109 and subsequent updates.

The flaw requires the attacker to control or inject code into the renderer process, which typically requires exploiting another vulnerability or gaining user credentials. Once the renderer is compromised, the attacker can serve a specially crafted HTML page that uses Skia to read memory that contains cross‑origin data, leaking it to the attacker. The CVSS score is classified as 3.1 by Chromium. No EPSS score is available, and the vulnerability is not currently listed in the CISA KEV catalogue, indicating that we have no statistical data on active exploitation.