This vulnerability arises from insufficient validation of untrusted input within the DevTools component of Google Chrome versions before 149.0.7827.53. An attacker who has already compromised the renderer process can exploit this flaw to inject arbitrary scripts or HTML, leading to a UXSS vulnerability. The CVSS vector indicates the attack requires network access, low attack complexity, no privileges, user interaction, and results in partial confidentiality and integrity impact without availability impact. The vulnerability is categorized under CWE-20 (Improper Input Validation).

Successful exploitation allows an attacker with control over the renderer process to perform script or HTML injection via crafted HTML pages, potentially leading to UXSS attacks. This can compromise confidentiality and integrity of user data within the affected browser context. There is no indication of availability impact. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for current remediation guidance. Users and administrators should monitor this advisory for updates. Until a patch is confirmed, limiting exposure to untrusted content and ensuring Chrome is updated promptly when fixes are released is recommended.