This vulnerability arises from improper input validation in the WebAppInstalls feature of Google Chrome versions before 149.0.7827.53. An attacker with control over the renderer process can exploit this to bypass the same origin policy, potentially enabling unauthorized access to web resources across origins. The issue was publicly disclosed on June 4, 2026, but no direct patch or remediation level is confirmed in the provided data. The vendor advisory link points to a Chrome stable channel update blog, which should be checked for official patch information.

The impact is a bypass of the same origin policy, which is a fundamental security control in web browsers. This could allow an attacker who has compromised the renderer process to access or manipulate content from different origins, potentially leading to data leakage or unauthorized actions within the browser context. However, the vulnerability requires prior compromise of the renderer process, which limits the initial attack vector.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for current remediation guidance. Until an official fix is confirmed, users should update to the latest Chrome version once available. No additional vendor-provided mitigations are specified.