An out-of-bounds read occurs in Skia when a crafted HTML page is processed by Google Chrome before version 146.0.7680.153. The bug allows a remote attacker to read memory locations outside the bounds of a buffer, potentially exposing arbitrary data stored in Chrome's process memory. This can lead to leakage of sensitive information such as credentials, cookies, or other private data, thereby compromising confidentiality.

Any installation of Google Chrome on Windows, macOS, or Linux is vulnerable if it runs a version earlier than 146.0.7680.153. The issue exists across all platforms supported by Chrome, regardless of operating system, because the underlying Skia library is cross‑platform.

The CVSS v3 score of 8.8 classifies this as a High severity vulnerability. The EPSS score of less than 1% indicates a low likelihood of widespread exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is via a malicious HTML page served over the network or opened locally, requiring the user to visit or open the crafted content. While the flaw does not provide direct code execution, the resulting memory disclosure could be leveraged by an attacker to compromise user data or leverage additional weaknesses.