This vulnerability in Google Chrome's WebAppInstalls component allows a remote attacker, with control over the renderer process, to bypass the same origin policy by leveraging insufficient input validation. The flaw exists in versions before 149.0.7827.53. The same origin policy is a critical security mechanism that restricts how documents or scripts loaded from one origin can interact with resources from another origin. Bypassing this policy can lead to unauthorized interactions between web origins, potentially enabling malicious actions within the browser context. The CVSS score is 6.5 (medium severity), reflecting a network attack vector with low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact. No known exploits in the wild have been reported. The vendor advisory link is provided but does not explicitly state patch or remediation status.

An attacker who has compromised the renderer process can bypass the same origin policy, potentially allowing unauthorized manipulation or interaction with web content from different origins. This impacts the integrity of web content isolation within the browser, which could facilitate further attacks or data manipulation within the browser context. There is no direct confidentiality or availability impact reported.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for current remediation guidance. Since the vulnerability affects Chrome versions prior to 149.0.7827.53, updating to version 149.0.7827.53 or later is recommended once confirmed by the vendor. No other specific mitigations are provided in the advisory.