This vulnerability involves an out-of-bounds read in the Skia graphics library within Google Chrome before version 148.0.7778.96. An attacker with control over the renderer process can exploit this flaw via a crafted Chrome Extension to leak data across origins, potentially exposing sensitive information. The issue is recognized by Chromium security as medium severity. No CVSS score or detailed remediation status is provided in the input data. The vendor advisory URL references a stable channel update but does not explicitly state if this vulnerability is fixed in that update.

If exploited, this vulnerability could allow an attacker who has already compromised the renderer process to leak cross-origin data, potentially exposing sensitive information from other web origins. The impact is limited to information disclosure and requires prior compromise of the renderer process. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html for current remediation guidance. Until confirmation of a fix, users should be cautious with Chrome Extensions and avoid installing untrusted extensions. Monitor official Google Chrome release notes for updates addressing this vulnerability.