This vulnerability arises from insufficient validation of untrusted input within Chrome extensions in versions before 149.0.7827.53. An attacker who has already compromised the renderer process can exploit this to bypass the same origin policy, potentially enabling unauthorized access or interaction with content from different origins. The issue is tracked as CWE-20 (Improper Input Validation). The CVSS vector indicates a network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact. The vendor advisory linked does not explicitly state if a fix is available or planned.

The vulnerability allows bypassing the same origin policy, which can lead to integrity violations by enabling an attacker to perform unauthorized actions or manipulate data across origins. However, it does not impact confidentiality or availability. Exploitation requires prior compromise of the renderer process and user interaction. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for current remediation guidance. Until an official fix is confirmed, users should exercise caution with untrusted content and extensions. No vendor advisory states that no action is required or that the issue is already mitigated.