An inappropriate implementation of the SVG engine in Google Chrome before version 149.0.7827.53 enables a remote attacker to craft an HTML page that forces the browser to expose data from a different origin. The flaw allows data leakage without any authentication or code execution, resulting in a confidentiality breach that could reveal sensitive information such as cookies, local storage, or other web‑app data that the victim normally cannot access.

Google Chrome browsers using versions prior to 149.0.7827.53 are affected.

This vulnerability is exploitable by a remote attacker who can host or influence a crafted HTML page, making it possible to read cross‑origin content from the victim’s session. Since there is no authentication requirement and no privileged execution needed, the risk is high for end users browsing untrusted sites. The CVSS score is 6.5, indicating a medium severity, and the EPSS score is less than 1%; the flaw is not listed in the CISA KEV catalog, but the potential impact on data confidentiality warrants prompt attention.