The vulnerability stems from an improper handling of XML data in Google Chrome, permitting a remote attacker to inject arbitrary scripts or HTML content when a crafted page is loaded. This grants the attacker the ability to execute code in the context of the victim’s browser, potentially compromising sensitive information such as cookies, session credentials, or user data. The flaw is classified as a user‑experience cross‑site scripting issue (CWE‑79), with a medium severity rating reported by Chromium.

Google Chrome browsers on all supported operating systems are affected; the flaw applies to any build prior to the latest update that contains the XML parsing fix.

The CVSS score is 6.1, and the EPSS score is < 1%, with the vulnerability not listed in the CISA KEV catalog. A remote attacker can trigger exploitation by hosting or luring a user to a specially crafted HTML page that contains malicious XML content, which is then parsed by Chrome and executed. As the attack requires user interaction to load the page, the overall exploitability is moderate, with potential impact on confidentiality, integrity, and availability of the browser session.