This vulnerability in Google Chrome affects the Autofill component where insufficient policy enforcement allows a remote attacker to bypass discretionary access control mechanisms by using a specially crafted HTML page. The issue is tracked as CWE-284 (Improper Access Control). The CVSS v3.1 base score is 6.5 (medium), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact. The affected version is prior to 149.0.7827.53. The vendor advisory URL is provided but does not explicitly state if a patch is available or if the issue is mitigated.

The vulnerability allows an attacker to bypass discretionary access controls in the Autofill feature, potentially leading to unauthorized modification or injection of data (integrity impact). There is no confidentiality or availability impact reported. No known exploits in the wild have been documented at this time.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for current remediation guidance. Until official confirmation, users should consider updating to version 149.0.7827.53 or later if available. No specific temporary mitigations are provided by the vendor advisory.