This vulnerability involves an inappropriate implementation in the Media component of Google Chrome before version 149.0.7827.53. It enables a remote attacker to leak cross-origin data by exploiting the way crafted HTML pages are handled. The CVSS v3.1 score is 6.5, reflecting a network attack vector with low attack complexity, no privileges required, user interaction needed, unchanged scope, and high confidentiality impact without affecting integrity or availability. No known exploits are reported in the wild. The vendor advisory link is provided but does not explicitly state a remediation level or patch availability.

An attacker can remotely cause leakage of sensitive cross-origin data, impacting user confidentiality. There is no impact on data integrity or system availability. The vulnerability requires user interaction and can be exploited without privileges.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for current remediation guidance. Users should update to Chrome version 149.0.7827.53 or later once the patch is confirmed. Until then, cautious browsing and avoiding untrusted HTML content may reduce risk.