This vulnerability in Google Chrome's WebView on Android arises from insufficient validation of untrusted input. An attacker with control over the renderer process can exploit this flaw to leak cross-origin data by crafting a malicious HTML page. The CVSS 3.1 base score is 6.5, reflecting a medium severity with high confidentiality impact but no integrity or availability impact. The affected version is any prior to 149.0.7827.53. The vendor advisory is linked but does not explicitly state if a fix has been released or if mitigation is available.

Successful exploitation allows an attacker who has already compromised the renderer process to leak sensitive cross-origin data, impacting confidentiality. There is no impact on integrity or availability. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for current remediation guidance. Until an official fix is confirmed, users should exercise caution with untrusted content in WebView on affected versions. No specific mitigations are detailed in the advisory.