The vulnerability is a use‑after‑free flaw in the Skia graphics library used by Google Chrome. When the renderer process accesses freed memory, code crafted in a web page can trick the browser into reading data that belongs to a different origin. This memory safety error is classified as CWE‑416 and can lead to the unintended disclosure of cross‑origin information.

Affected systems are users of Google Chrome versions older than 153.0.8010.47 on desktop platforms. The flaw exists in the renderer component of the browser, so any Chrome installation that has not applied the October 2026 stable channel update is vulnerable.

The CVSS score of 3.1 indicates a low overall severity, and the EPSS score of less than 1% shows a very small probability that the flaw is actively exploited. The issue is not listed in CISA’s KEV catalog. Exploitation requires an attacker to have already compromised the renderer process, which limits the attack surface. Once that condition is met, the attacker can obtain cross‑origin data but cannot gain direct code execution or full system compromise.