This vulnerability arises from insufficient validation of untrusted input within the codecs component of Google Chrome versions before 149.0.7827.53. An attacker who has already compromised the renderer process can exploit this flaw by delivering a crafted video file that causes leakage of cross-origin data. The issue is tracked as CWE-20 (Improper Input Validation). There is no explicit vendor advisory stating a patch or remediation level, and no known exploits in the wild have been reported as of the published date.

The vulnerability allows an attacker with control over the renderer process to leak sensitive cross-origin data, potentially violating the same-origin policy and exposing confidential information. There is no indication of impact on integrity or availability, and exploitation requires prior compromise of the renderer process.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for current remediation guidance. Until an official fix is confirmed, users should exercise caution with untrusted video content and ensure their Chrome browser is updated to the latest available version.