Google Chrome EUVD-2026-91716

Exploitation requires the victim to load attacker-controlled web content in Chrome - specifically a crafted HTML page embedding or referencing a malicious SVG that triggers the information leak; this is the mandatory user-interaction gate (UI:R). No authentication or privileges are needed on the target (PR:N), and default Chrome configurations are affected since SVG rendering is a core, always-enabled browser capability. The primary limiting factor is that the attacker cannot act without the victim navigating to the malicious page, and only Chrome versions prior to 154.0.8037.97 are vulnerable; updated browsers are not exploitable.

This is a medium-severity information disclosure flaw (CVSS 6.5) in Google Chrome's SVG handling. The signals are broadly consistent and point to a moderate, not urgent, priority. The CVSS vector (AV:N/AC:L/PR:N/UI:R) indicates a remote, unauthenticated attacker can trigger it with low complexity, but exploitation requires user interaction - the victim must visit or render a crafted HTML page, which meaningfully limits mass exploitation. The EPSS score is very low (0.17%, 6th percentile), and SSVC records Exploitation=none and Automatable=no, reinforcing that no active or automatable exploitation is known. There is a notable tension in the impact signals: the CVSS confidentiality impact is rated High (C:H) and SSVC Technical Impact is 'total,' which sounds severe, yet the Chromium team self-rated this only 'Medium' severity and it is an information leak with no integrity or availability impact (I:N/A:N). The SSVC 'total' technical-impact label should be read as applying to the confidentiality dimension only, not full system compromise - do not over-weight it. No CISA KEV listing and no public exploit code were identified, so this is not a confirmed exploited vulnerability. Net: a patch-in-normal-cycle browser infoleak, elevated slightly by Chrome's ubiquity but tempered by the user-interaction requirement and absence of exploitation evidence.

An attacker hosts or injects a malicious web page containing a crafted SVG that abuses Chrome's SVG processing to leak sensitive in-memory or cross-origin data back to the attacker. The victim is lured (phishing link, malicious ad, or compromised site) into opening the page, and because exploitation needs no privileges but does require that page load (UI:R), the attacker depends on social engineering rather than silent compromise. No public proof-of-concept exploit was identified at time of analysis.