This vulnerability arises from insufficient enforcement of security policies within the ServiceWorker implementation in Google Chrome versions prior to 149.0.7827.53. An attacker can exploit this weakness by crafting a malicious HTML page that causes cross-origin data leakage, violating the same-origin policy. The issue is classified as medium severity by the Chromium security team. No CVSS score is provided. The vendor advisory linked references a stable channel update for desktop Chrome, implying that remediation may be addressed in version 149.0.7827.53 or later, but explicit patch confirmation is not stated in the input data.

The vulnerability enables remote attackers to bypass policy enforcement in ServiceWorker, leading to unauthorized leakage of cross-origin data. This compromises data confidentiality between different web origins. No evidence of active exploitation in the wild is reported. The impact is limited to affected versions of Google Chrome prior to 149.0.7827.53 on desktop platforms.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for current remediation guidance. Users should update to Chrome version 149.0.7827.53 or later once available. Until then, no specific mitigations are provided by the vendor advisory. Monitor official Google Chrome release notes for updates.