This vulnerability arises from improper validation in the DataTransfer component of Google Chrome versions before 149.0.7827.53. It enables remote attackers to bypass same-origin policy restrictions and leak data across origins via a specially crafted HTML page. The issue is classified as medium severity by Chromium security. The vulnerability was publicly disclosed on June 4, 2026. No CVSS score or detailed remediation information is provided in the available data. The vendor advisory URL points to a Chrome stable channel update blog, but patch status is not explicitly stated.

The vulnerability allows remote attackers to leak cross-origin data, potentially exposing sensitive information accessible within the browser context. This could undermine user privacy and confidentiality of web data. However, no evidence of active exploitation in the wild has been reported. The impact is limited to data leakage rather than code execution or system compromise.

Patch status is not yet confirmed—check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for current remediation guidance. Users and administrators should monitor official Google Chrome updates and apply any available fixes promptly once confirmed. Until a patch is confirmed, consider limiting exposure to untrusted web content and exercising caution with unknown HTML pages that could exploit this vulnerability.