This vulnerability arises from inappropriate implementation in the SVG component of Google Chrome before version 150.0.7871.47. It allows a remote attacker to bypass cross-origin data restrictions, leading to potential data leakage through a specially crafted HTML page. The CVSS score is 6.5 (medium severity) with an attack vector of network, low attack complexity, no privileges required, user interaction required, unchanged scope, and high confidentiality impact. The vulnerability is categorized under CWE-352 (Cross-Site Request Forgery). The vendor advisory is linked but does not explicitly state if a patch is available or if the issue is mitigated.

The vulnerability enables remote attackers to leak sensitive cross-origin data, compromising confidentiality. There is no impact on integrity or availability. User interaction is required for exploitation, and the attack complexity is low. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html for current remediation guidance. Until official confirmation, users should update to the latest Chrome version once available and exercise caution with untrusted web content that may exploit SVG rendering.