This vulnerability in Google Chrome arises from an inappropriate implementation of CSS policy enforcement that enables a remote attacker to leak cross-origin data by crafting a malicious HTML page. The issue affects versions prior to 149.0.7827.53. The CVSS 3.1 base score is 4.3, indicating a medium severity with network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and limited confidentiality impact. There is no vendor advisory content explicitly stating a fix or mitigation, and no known exploits have been reported.

An attacker can remotely cause a cross-origin data leak, potentially exposing sensitive information from other origins. The impact is limited to confidentiality loss without affecting integrity or availability. No active exploitation has been observed.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for current remediation guidance. Until an official fix is confirmed, users should exercise caution when visiting untrusted websites and avoid interacting with suspicious content that could exploit this vulnerability.