Chrome versions before 150.0.7871.47 have an SVG implementation that can be tricked by a maliciously crafted HTML page, enabling a remote attacker to read data that belongs to another web origin. The flaw does not provide any form of code execution, privilege escalation, or authentication bypass; it only allows sensitive information disclosure across origins. The vulnerability is classified as medium severity by Chromium, with a CVSS score of 6.5, and it is listed as a CWE-352 weakness related to cross‑site request forgery context requires a victim to visit a malicious webpage that includes the crafted SVG, with no special privileges needed.

All users of Google Chrome whose installed version is older than 150.0.7871.47 are affected. The issue resides in the core SVG processing engine, so it applies to all supported platforms and operating systems.

Based on the CVSS score of 6.5, the vulnerability is medium severity, primarily affecting data confidentiality. The EPSS score indicates a very low likelihood of exploitation in the wild, and the flaw is not catalogued in CISA’s KEV. The attack requires a victim to open a maliciously crafted HTML page that includes the vulnerable SVG handling; no elevated privileges or code execution are needed. Because the vector is browser‑based, the risk is concentrated in phishing or compromised‑site scenarios, but the overall threat remains limited to leaking cross‑origin data rather than broader system compromise.