This vulnerability involves an inappropriate implementation in the Skia graphics library used by Google Chrome before version 151.0.7922.72. It enables a remote attacker, who already has control over the renderer process, to leak data across origins by crafting a malicious HTML page. The issue is identified as CWE-346 (Inadequate Verification of Data Authenticity). The CVSS 3.1 base score is 3.1, reflecting low impact with network attack vector, high attack complexity, no privileges required, user interaction required, unchanged scope, and low confidentiality impact. The vendor advisory linked does not explicitly confirm a patch or remediation status.

The impact is limited to potential cross-origin data leakage by an attacker who has already compromised the renderer process. There is no reported impact on integrity or availability. The confidentiality impact is low, and no known exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should update to Chrome version 151.0.7922.72 or later once available. Until then, no specific mitigation steps are provided by the vendor advisory.