This vulnerability in Google Chrome's Skia component arises from insufficient validation of untrusted input. An attacker with control over the renderer process can exploit this flaw to leak cross-origin data by using a specially crafted HTML page. The issue affects Chrome versions before 149.0.7827.53. The CVSS v3.1 base score is 6.5, reflecting a network attack vector with low attack complexity, no privileges required, user interaction needed, unchanged scope, and high confidentiality impact without integrity or availability impact. No official remediation level or patch link is explicitly stated, but the vendor advisory URL points to a stable channel update blog, suggesting that the issue is addressed in or by version 149.0.7827.53.

Successful exploitation allows an attacker who has already compromised the renderer process to leak sensitive cross-origin data, impacting confidentiality. There is no impact on integrity or availability. The vulnerability requires user interaction and does not require privileges or elevated access beyond the renderer compromise.

The vulnerability affects versions of Google Chrome prior to 149.0.7827.53. Users and administrators should update to version 149.0.7827.53 or later to remediate this issue. The vendor advisory linked (https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html) should be consulted for confirmation and additional details. No other mitigation or temporary fixes are indicated.