This vulnerability in Google Chrome's Workers component prior to version 149.0.7827.53 allows a remote attacker to bypass the same origin policy through a specially crafted HTML page. The issue is classified under CWE-346 (Inadequate Verification of Data Authenticity) and has a CVSS 3.1 base score of 6.5, indicating a medium severity level. The attack vector is network-based with low attack complexity, no privileges required, and requires user interaction. The impact affects integrity but not confidentiality or availability. No known exploits are reported in the wild. The vendor advisory linked does not explicitly confirm a patch or remediation status.

The vulnerability allows bypassing the same origin policy, potentially enabling an attacker to perform unauthorized actions or manipulate data integrity in the context of web workers. Confidentiality and availability are not impacted according to the CVSS vector. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for current remediation guidance. Until an official fix is confirmed, users should exercise caution when interacting with untrusted web content that might exploit this vulnerability.