This vulnerability in Google Chrome's WebAppInstalls component arises from insufficient validation of untrusted input. An attacker who has already compromised the renderer process can exploit this flaw to leak cross-origin data by crafting a malicious HTML page. The CVSS 3.1 base score is 6.5 (medium severity), reflecting a network attack vector with low attack complexity, no privileges required, and user interaction needed. The impact is high confidentiality loss without integrity or availability impact. The affected versions include Chrome versions prior to 149.0.7827.53. The vendor advisory linked does not explicitly state if a fix has been released, so patch status is not confirmed.

The vulnerability allows an attacker who has compromised the renderer process to leak sensitive cross-origin data, resulting in a confidentiality breach. There is no impact on integrity or availability. The attack requires user interaction and can be executed remotely over the network.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for current remediation guidance. Until a fix is confirmed, users should exercise caution with untrusted content and consider limiting exposure to potentially malicious web pages. No official fix or temporary workaround is explicitly stated in the provided advisory.