In versions of Google Chrome before 149.0.7827.53 an SVG implementation flaw allows a remote attacker to inject arbitrary scripts or HTML into a rendered page. The injected code executes in the context of the user’s browser, giving the attacker the capacity to steal credentials, hijack sessions or run additional malicious payloads. This behavior represents a cross‑site scripting style vulnerability that can compromise the confidentiality, integrity and availability of the user’s data and the system’s security state.

Any computer running Google Chrome under build 149.0.7827.53, whether on Windows, macOS, Linux or any Chrome‑based derivative that shares the same rendering engine, is susceptible if it renders user‑supplied HTML. The flaw impacts all such instances where an attacker can supply crafted HTML content.

The CVSS score of 6.8 indicates medium severity. The EPSS score is reported as < 1% and the issue does not appear in the CISA KEV catalog, implying low current exploitation evidence. A user would need to open a crafted page containing malicious SVG or click a malicious link. While no public exploit is known, the potential impact is notable should an attacker obtain a delivery mechanism.