This vulnerability arises from insufficient policy enforcement within the SVG handling subsystem of Google Chrome. It enables an attacker to serve a crafted HTML page that causes the browser to read and expose data from a different origin, thereby leaking sensitive information that should be confined by the same‑origin policy. The flaw is a direct violation of web‑security principles and could provide confidentiality exposure to a remote adversary.

All users of Google Chrome versions earlier than 150.0.7871.47 are affected. The issue is specific to the stable channel of the Chrome browser and applies to all platforms that receive the same version from Google.

The vulnerability is rated high by Chromium, but the EPSS score is not available and it is not listed in CISA’s KEV catalog. A remote attacker can exploit it by hosting a malicious web page that includes the targeted SVG content. If the victim visits that page, the browser will silently undermine its origin checks, and the attacker can read data across origins. Because no defensive configuration is required, the exploitation likelihood is considered significant unless mitigated by an updated browser release or content‑security restrictions.