This vulnerability in Google Chrome affects versions prior to 149.0.7827.53 and is caused by insufficient validation of untrusted input in the Plugins component. An attacker who has already compromised the renderer process can exploit this to leak cross-origin data by using a specially crafted HTML page. The issue is categorized under CWE-20 (Improper Input Validation). Although the CVSS score is 7.5 indicating high severity, no official remediation level or patch details are provided in the vendor advisory. The vendor advisory URL references a stable channel update but does not explicitly confirm a fix for this specific CVE.

The impact of this vulnerability is the unauthorized disclosure of cross-origin data, which can lead to information leakage. The attacker must have already compromised the renderer process to exploit this vulnerability. There is no indication of integrity or availability impact. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for current remediation guidance. Until a patch is confirmed, users should apply the latest Chrome updates as they become available and follow Google’s official update channels. No specific temporary mitigations are provided.