This vulnerability in Google Chrome's Glic component arises from insufficient validation of untrusted input, which can be exploited by a remote attacker with control over the renderer process to leak cross-origin data. The issue affects Chrome versions prior to 149.0.7827.53. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high confidentiality impact. The vendor advisory linked does not explicitly state the availability of a patch or remediation level, so patch status is not confirmed.

An attacker who has already compromised the renderer process can exploit this vulnerability to leak sensitive cross-origin data, potentially exposing confidential information. There is no impact on integrity or availability. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for current remediation guidance. Until confirmation of a fix, users should exercise caution with untrusted content and consider updating to the latest Chrome version once a patch is confirmed.