This vulnerability is an out‑of‑bounds read within the Skia graphics library used by Google Chrome. When a renderer process, which has already been compromised by a remote attacker, processes a specially crafted HTML page, the attacker can read memory inside the sandbox. The read does not change memory contents, but it allows the attacker to leak potentially sensitive information that may be stored in the renderer process. The issue is considered low severity by Chromium, yet the memory disclosure could expose data that the sandbox is intended to protect.

Google Chrome versions earlier than 152.0.7977.65 on all platforms are affected. The issue occurs in the renderer component that handles rendering of web content. It does not affect other Chrome components directly.

Because the attacker must first compromise the renderer process and then supply a crafted HTML page, the vectors examined are exploitation via malicious web content and successful renderer compromise. The EPSS score of < 1% indicates a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The CVSS score of 6.5 indicates a low‑to‑moderate severity. Nonetheless, the ability to read sandboxed memory can assist further attacks, making it prudent to mitigate promptly.