This vulnerability in Google Chrome relates to insufficient validation of untrusted input within the Subresource Integrity mechanism. Specifically, in versions before 149.0.7827.53, an attacker could bypass the content security policy by leveraging malicious network traffic. The issue is categorized under CWE-20 (Improper Input Validation). The CVSS v3.1 base score is 6.5, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact. The vendor advisory link is provided but does not explicitly state if a fix is available or if users must take action.

The vulnerability allows attackers to bypass content security policy protections, potentially enabling integrity violations such as injecting or modifying web resources. There is no impact on confidentiality or availability. The medium severity score reflects the potential for integrity compromise without direct data disclosure or service disruption. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for current remediation guidance. Until confirmation of a fix, users should exercise caution with untrusted content and consider applying any available Chrome updates promptly once released.