This vulnerability arises from improper validation in the DataTransfer component of Google Chrome before version 149.0.7827.53. An attacker can exploit this flaw by crafting a malicious HTML page that causes cross-origin data leakage, violating the same-origin policy. The CVSS score is 4.3 (medium), indicating a network attack vector with low complexity and no privileges required, but user interaction is necessary. The vulnerability impacts confidentiality but not integrity or availability. The vendor advisory linked does not explicitly state if a fix is available or pending.

An attacker can remotely cause leakage of cross-origin data, potentially exposing sensitive information from other origins to the attacker. The impact is limited to confidentiality loss; there is no impact on data integrity or system availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for current remediation guidance. Until an official fix is confirmed, users should exercise caution when interacting with untrusted web content, especially involving drag-and-drop or clipboard operations that use DataTransfer. No specific temporary mitigations are documented by the vendor.