This vulnerability in Google Chrome before version 149.0.7827.53 involves improper handling within Extensions that can be exploited by a remote attacker using a specially crafted XML file to leak cross-origin data. The flaw relates to the browser's extension implementation and cross-origin data protections. The Chromium security team has rated this issue as medium severity. The vendor advisory linked does not explicitly confirm patch availability or remediation level, and no CVSS score is assigned.

Successful exploitation could allow a remote attacker to bypass cross-origin data restrictions and leak data from other origins, potentially exposing sensitive information accessible through the browser extensions. However, there are no reports of active exploitation in the wild. The impact is limited to data leakage rather than code execution or system compromise.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for current remediation guidance. Users should update to Chrome version 149.0.7827.53 or later once confirmed. Until then, cautious handling of untrusted XML files and limiting extension permissions may reduce risk.