A side‑channel vulnerability in Google Chrome’s handling of SVG files allows a remote attacker to leak cross‑origin data via a crafted HTML page. The flaw, classified as CWE‑1300 and CWE‑205, exposes sensitive information that should otherwise be protected by the same‑origin policy. By manipulating the SVG rendering process, the attacker can trick the browser into revealing data from other origins, thereby enabling credential compromise or other privacy violations.

Google Chrome users running versions prior to 151.0.7922.72 are vulnerable. The issue was present in this browser build and was addressed in the 151.0.7922.72 update released in the July 2026 stable channel.

The CVSS score of 4.3 and an EPSS of less than 1% indicate a moderate, low‑risk scenario. The vulnerability is not listed in the CISA KEV catalog, and exploitation requires an attacker to convince a victim to view a maliciously crafted page. While remote in nature, the attack vector would be through an innocuous HTML page that contains the vulnerable SVG.