The vulnerability arises from an improper bounds check in the handling of SVG elements within the Chrome rendering engine. In vulnerable versions of Chrome, a remote attacker can supply a specially crafted SVG file embedded in a malicious web page. When the page renders, the resulting memory corruption permits the attacker to read sensitive data from process memory, effectively leaking confidential information. This issue is classified as a classic buffer overflow (CWE‑119), providing an attack surface that could be leveraged to extract secrets or credentials if the attacker can place the SVG within a page.

The flaw affects Google Chrome for desktop on all platforms that use the affected renderer, including Windows, macOS, Linux, and Chrome OS. Any instance of Chrome with a version number older than 155.0.8059.84 is vulnerable. Google has released patch 155.0.8059.84 as part of its stable‑channel update, which removes the flaw. Users operating on the Canary or Beta branches should also ensure they have the latest builds that include the fix.

With a CVSS base score of 4.3 the vulnerability is considered moderate, yet the memory disclosure could assist in further attacks such as credential theft or session hijacking. The EPSS score is 0.00178 (< 1%), indicating a very low probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog at this time. Because the exploit requires a malicious web page to be loaded in the targeted browser, it is an “e‑mail or web” attack vector that can be delivered through phishing or compromised sites. No public exploit is verified, so the likelihood of exploitation remains limited; however, administrators should still patch promptly to avoid any potential zero‑day abuse.