This vulnerability involves a side-channel information leak in the Paint component of Google Chrome before version 149.0.7827.53. An attacker can exploit this by creating a specially crafted HTML page to leak data across origins, potentially exposing information that should be isolated by the browser's same-origin policy. The issue is classified as low severity by the Chromium security team. The vulnerability was publicly disclosed on June 4, 2026, and a stable update was released to remediate it.

A remote attacker can leak cross-origin data via a crafted HTML page, potentially exposing sensitive information from other origins within the browser context. The impact is considered low severity by the vendor, indicating limited risk or difficulty in exploitation. There are no reports of active exploitation in the wild.

Users and administrators should update Google Chrome to version 149.0.7827.53 or later, where this vulnerability has been fixed. The vendor advisory confirms the availability of this stable channel update. No additional mitigation steps are indicated by the vendor.