The vulnerability CVE-2026-10980 affects Google Chrome versions prior to 149.0.7827.53. It arises from insufficient validation of untrusted input within the DevTools component, enabling a remote attacker with control over the renderer process to bypass the same origin policy through a crafted HTML page. This could lead to unauthorized interactions between different origins in the browser context. The CVSS vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact. The vendor advisory link is provided but does not explicitly state patch availability or remediation details.

An attacker who has already compromised the renderer process can exploit this vulnerability to bypass the same origin policy, potentially allowing unauthorized access or manipulation of web content across origins. This impacts the integrity of web content but does not affect confidentiality or availability. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for current remediation guidance. Until official fixes are confirmed, users should apply updates promptly once available and exercise caution with untrusted content in the browser.