This vulnerability arises from insufficient validation of untrusted input in the WebUI component of Google Chrome versions before 149.0.7827.53. An attacker with control over the renderer process could exploit this flaw to leak data across origins by crafting a malicious HTML page. The issue is classified under CWE-20 (Improper Input Validation). The CVSS v3.1 base score is 6.5, indicating a medium severity with network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high confidentiality impact.

Successful exploitation allows a remote attacker who has already compromised the renderer process to leak sensitive cross-origin data, impacting confidentiality. There is no impact on integrity or availability. The vulnerability requires user interaction and does not require privileges, making it moderately exploitable in scenarios where the renderer process is compromised.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for current remediation guidance. No official fix or temporary workaround is explicitly stated in the provided data. Users and administrators should monitor the vendor advisory for updates and apply any released patches promptly.