This vulnerability arises from an inappropriate implementation in the CSS handling of Google Chrome versions before 149.0.7827.53. It enables a remote attacker to bypass same-origin policy restrictions and leak data from other origins by crafting a malicious HTML page. The CVSS score is 4.3 (medium), reflecting a network attack vector with low complexity and no privileges required but requiring user interaction. The impact is limited to confidentiality loss without affecting integrity or availability. No official fix or remediation level is stated in the vendor advisory, and no known exploits have been observed.

An attacker can remotely cause cross-origin data leakage through crafted HTML content due to insufficient policy enforcement in CSS. This results in limited confidentiality compromise but does not affect data integrity or system availability. No evidence of active exploitation is currently known.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for current remediation guidance. Until an official fix is confirmed, users should exercise caution when visiting untrusted websites and consider applying any available updates promptly once released.