This vulnerability involves a heap buffer overflow in the Skia graphics library used by Google Chrome before version 147.0.7727.101. Exploitation requires a user interaction (UI:R) and network access (AV:N) but no privileges. Successful exploitation can lead to disclosure of sensitive information from the browser's process memory. The CVSS vector indicates low complexity and no impact on integrity or availability, only confidentiality is affected to a limited extent.

An attacker who successfully exploits this vulnerability can obtain potentially sensitive information from the memory of the Chrome process. The impact is limited to confidentiality with no effect on integrity or availability. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop_15.html for current remediation guidance. Users should update to Chrome version 147.0.7727.101 or later once available to address this issue. Until then, exercise caution when visiting untrusted websites and avoid interacting with suspicious HTML content.