This vulnerability in Google Chrome's WebUI component arises from insufficient validation of untrusted input, enabling a remote attacker with control over the renderer process to leak data across origins through a specially crafted HTML page. It affects Chrome versions prior to 149.0.7827.53. The Chromium security team rates this issue as medium severity. No CVSS score is assigned, and no direct patch or remediation level is specified in the provided data. The vendor advisory link points to a stable channel update announcement that may contain relevant remediation details.

An attacker who has already compromised the renderer process can exploit this vulnerability to leak cross-origin data, potentially exposing sensitive information from other origins within the browser context. The impact is limited to data leakage and requires prior compromise of the renderer process, which reduces the overall risk compared to remote code execution vulnerabilities.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for current remediation guidance. Users should update to Chrome version 149.0.7827.53 or later once confirmed. Until then, no specific mitigation steps are detailed in the advisory or CVE description.