The vulnerability is an uninitialized resource bug in the Skia graphics engine used by Google Chrome. When a maliciously crafted HTML page is rendered, the browser may read uninitialized memory and expose cross‑origin data. This leads to a confidentiality breach that could allow an attacker to discreetly harvest data from other domains that the browser has accessed before. The weakness is classified as CWE‑908. Based on the description, it is inferred that the attack vector involves a remote web page that must be opened by the victim.

Google Chrome browsers running versions earlier than 153.0.8010.47 are affected. Based on the announcement of a stable channel update targeted at desktop, it is inferred that the vulnerability applies to desktop operating systems; data about other platforms is not explicitly stated in the CVE description.

The CVSS base score of 4.3 indicates a medium potential impact, while the EPSS score of <1% shows a low probability of exploitation at this time. The flaw is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attacker must deliver a crafted HTML page to the victim – a remote attack vector – after the page loads the uninitialized Skia resource can be exploited to leak data.