This vulnerability in Google Chrome affects the Password Manager component due to insufficient policy enforcement. An attacker with control over the renderer process can bypass site isolation protections by leveraging a crafted HTML page. The issue is fixed in Chrome version 149.0.7827.53. The vulnerability is rated medium severity by Chromium security, but no CVSS score is provided. The vendor advisory is available but does not explicitly confirm patch availability or remediation level.

If exploited, this vulnerability allows an attacker who has already compromised the renderer process to bypass site isolation, potentially increasing the risk of cross-site data leakage or unauthorized access to sensitive information managed by the Password Manager. However, exploitation requires prior compromise of the renderer process, limiting the attack surface. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for current remediation guidance. Users should update to Chrome version 149.0.7827.53 or later once confirmed. Until then, no additional specific mitigations are provided by the vendor.