CVE-2026-19160 is an uninitialized use vulnerability in the Skia component of Google Chrome before version 151.0.7922.109. This flaw allows a remote attacker, who has already compromised the renderer process, to leak cross-origin data by leveraging uninitialized memory usage triggered by a crafted HTML page. The vulnerability is classified under CWE-457 (Use of Uninitialized Variable). The CVSS 3.1 base score is 3.1, reflecting low severity with network attack vector, high attack complexity, no privileges required, and requiring user interaction. Confidentiality impact is low, with no integrity or availability impact.

The vulnerability enables information leakage of cross-origin data if the attacker has already compromised the renderer process. The impact is limited to confidentiality with low severity. There is no direct integrity or availability impact. No known active exploitation has been reported.

A fix is available in Google Chrome version 151.0.7922.109 and later. Users and administrators should update to this version or later to remediate the vulnerability. Since this is a client-side vulnerability in Chrome, upgrading the browser is the recommended mitigation. No additional vendor advisory or patch links were provided, so users should verify the update status with official Google Chrome release notes.