The vulnerability arises from an object corruption bug within Chrome’s compositing subsystem. When a renderer process has already been compromised, an attacker can craft a malicious HTML page that forces the corrupted object to expose data from other origins, leading to a cross‑origin information leak. Although the flaw does not grant arbitrary code execution, it allows a knowledgeable attacker to read sensitive data that should be isolated by the browser’s same‑origin policy.

Affected browsers are those running any Chrome build earlier than version 148.0.7778.168. The product is Google Chrome for desktop platforms. Devices that rely on the stable channel were susceptible until the 148.0.7778.168 release.

The issue carries a low severity rating, with a CVSS score of 3.1, and a very low EPSS score of < 1%. The flaw requires an already compromised renderer process, so the usual attack vector involves prior compromise of user‑origin content or malicious web pages running in the renderer. Updating the browser to a patched version disables the vulnerable compositing path and stops the data leak.