This vulnerability arises from inadequate validation of untrusted input within the Codecs module of Google Chrome before version 149.0.7827.53. An attacker with control over the renderer process can exploit this flaw by supplying a crafted video file to leak data across origins, violating the same-origin policy. The issue was publicly disclosed on June 4, 2026, and is tracked as CVE-2026-10981. Although the Chromium security team rates this vulnerability as high severity, no CVSS score or explicit remediation level is provided in the available data. The vendor advisory link is provided but does not explicitly confirm patch availability or mitigation steps.

The vulnerability enables an attacker who has already compromised the renderer process to leak sensitive cross-origin data via crafted video content. This can lead to unauthorized disclosure of information that should be isolated by the browser's same-origin policy. There are no known exploits in the wild at the time of disclosure.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for current remediation guidance. Until official fixes are confirmed, users should update to the latest Chrome version when available and exercise caution with untrusted video content. No vendor advisory explicitly states that no action is required or that the issue is already mitigated.