Credit is to "Jihui Lu of KeenTeam (@K33nTeam), working with the Chromium vulnerability reward program"

I didn't manage to reproduce this on Linux x64 or virtualized Windows but filing because we trust the quality of KeenTeam submissions.

The accompanying write-up is excellent to attaching verbatim, along with PNG image that shows how the error looks in IE.


This bug is subject to a 90 day disclosure deadline. If 90 days elapse
without a broadly available patch, then the bug report will automatically
become visible to the public.

 

	Internet Explorer 11.png 70.3 KB View Download

	HelloTriangleColoredLeak.png 7.1 KB View Download

HelloTriangleColoredLeak.swf 6.1 KB Download

HelloTriangleColoredLeak.html 123 bytes View Download

ReadMe.txt 2.1 KB View Download