Chrome versions before 150.0.7871.47 contain an SVG implementation flaw that can be triggered by a carefully crafted HTML page, allowing a remote attacker to read data from a different origin held by the victim browser. The flaw does not enable code execution, privilege escalation, or authentication bypass; it simply leaks confidential information across origins. The weakness is classified as CWE‑352, and the Chromium team rates the issue as medium severity with a CVSS score of 6.5.

All users of Google Chrome whose installed version is older than 150.0.7871.47 are affected. The issue resides in the core SVG processing engine and applies to all supported platforms and operating systems.

The CVSS score of 6.5 places the vulnerability in the medium range, primarily impacting data confidentiality. The EPSS score of <1% indicates a very low probability of exploitation in the wild, and the vulnerability is not listed in CISA’s KEV catalog. The attack requires a victim to open a maliciously crafted HTML page that contains the vulnerable SVG handling; no elevated privileges or code execution are needed. Because the vector is browser‑based, the risk is concentrated in phishing or compromised‑site scenarios, but the overall threat remains limited to leaking cross‑origin data rather than broader system compromise.