The vulnerability stems from an inappropriate implementation in the SVG component of Google Chrome. It allows a remote attacker to craft an HTML page that instructs the browser to load a specially constructed SVG object, bypassing the same‑origin policy. The result is a leak of data that originates from a different origin, exposing sensitive information such as authentication tokens or private content. This flaw is classified as CWE‑346.

Affected releases include Google Chrome prior to version 151.0.7922.72. Any installation of Chrome that has not yet been updated to that release or later is vulnerable. The issue applies to all platforms that run Chrome with default SVG support enabled.

The CVSS score of 3.1 indicates a low severity disclosure risk, and the EPSS score of less than 1% suggests the likelihood of exploitation is low at present. The vulnerability is not listed in CISA’s KEV catalog. Attackers would need to host a malicious web page containing the crafted SVG payload and lure a user to visit the page. Because the flaw allows only information disclosure and requires a user‑initiated visit, widespread exploitation depends on the effectiveness of social engineering or phishing campaigns.