The flaw originates from insufficient validation of untrusted input in Skia, allowing a remote attacker who has already compromised the renderer process to supply a crafted print file that results in an out-of-bounds memory write. This memory corruption could alter data within the renderer, potentially affecting the integrity of the browsing session. No claim of arbitrary code execution is supported by the supplied description.

Google Chrome versions prior to 148.0.7778.168 on the stable desktop channel are affected. Versions 148.0.7778.168 and later include the fix for the Skia input validation issue.

The CVSS score of 3.1 classifies this vulnerability as low severity. An exploitable attack requires that the attacker already obtain code execution within Chrome's renderer process to serve a malicious print file. The EPSS score is 0.00047 (<1%), indicating a very low exploitation probability, yet the vulnerability is not listed in CISA KEV. Consequently, the danger remains moderate, contingent on the attacker’s ability to compromise the renderer; users on vulnerable versions should prioritize updating.