CVE-2026-19161 describes an uninitialized use vulnerability in the Skia graphics library within Google Chrome versions prior to 151.0.7922.109. This flaw enables a remote attacker, who has already compromised the renderer process, to leak cross-origin data by crafting a malicious HTML page. The vulnerability is associated with CWE-457 (Use of Uninitialized Variable). The CVSS 3.1 base score is 3.1, reflecting low impact with network attack vector, high attack complexity, no privileges required, user interaction required, and limited confidentiality impact.

The impact is limited to information disclosure of cross-origin data if the attacker has already compromised the renderer process. There is no integrity or availability impact reported. The vulnerability does not allow initial compromise but can be leveraged post-compromise to leak data across origins.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor official Google Chrome security advisories for updates addressing this vulnerability.