An inappropriate SVG implementation in Google Chrome prior to version 151.0.7922.72 enables a remote attacker to force the browser to read foreign origin data from a crafted HTML page. The flaw results in cross‑origin data disclosure but does not allow code execution or other higher‑level privileges. It matches CWE‑346, indicating insufficient origin checks when exposing data.

The vulnerability affects Google Chrome installations running versions prior to 151.0.7922.72. Versions that have received the 151.0.7922.72 update are unaffected. The description does not specify individual release channels, so any channel that includes the older code base may be at risk.

The CVSS score of 4.3 places this flaw in the low‑to‑moderate severity range, and the EPSS score of less than 1% signals a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. A potential attacker would need to supply a malicious web page that the victim loads in Chrome, ensuring cross‑origin SVG content is fetched; the browser would then incorrectly allow the malicious page to read that content.