This vulnerability in Google Chrome affects the enforcement of security policies within Workers, enabling an attacker with control over the renderer process to bypass the same origin policy through a specially crafted HTML page. The affected versions are those prior to 149.0.7827.53. The same origin policy is a critical browser security mechanism that restricts how documents or scripts loaded from one origin can interact with resources from another origin. Insufficient enforcement here could lead to unauthorized cross-origin interactions. The issue was publicly disclosed on June 4, 2026, but no CVSS score or explicit remediation level is provided in the available data.

If exploited, this vulnerability could allow an attacker who has already compromised the renderer process to bypass the same origin policy, potentially leading to unauthorized access to data or actions across origins within the browser context. However, exploitation requires prior compromise of the renderer process, which limits the attack surface. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for current remediation guidance. Until official fixes are confirmed, users should update to the latest Chrome version once available. No vendor advisory states that no action is required or that the issue is already mitigated.