This vulnerability arises from insufficient validation of untrusted input in the Skia component of Google Chrome before version 149.0.7827.103. It enables an out-of-bounds read that can be leveraged by an attacker with renderer process access to leak data across origins via a specially crafted HTML page. The issue was assigned CVE-2026-11675 and classified with high security severity by Chromium. No CVSS score is available, and the vendor advisory linked may contain patch or mitigation details.

The impact is limited to information disclosure of cross-origin data when the attacker has already compromised the renderer process. This could lead to leakage of sensitive data from other origins within the browser context. There are no reports of active exploitation in the wild. The vulnerability does not allow initial compromise but escalates the risk post-compromise by enabling data leakage.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html for current remediation guidance. Users and administrators should apply the official Chrome update to version 149.0.7827.103 or later once available. Until patched, limiting exposure to untrusted content and restricting renderer process compromise vectors may reduce risk.