This vulnerability arises from insufficient validation of untrusted input within the WebAuthentication feature of Google Chrome versions before 149.0.7827.53. An attacker with control over the renderer process could exploit this to bypass the same origin policy by delivering a specially crafted HTML page. The same origin policy is a critical security mechanism that restricts how documents or scripts loaded from one origin can interact with resources from another origin. The issue is classified with low severity by the Chromium security team. No CVSS score is assigned, and no explicit remediation level or patch availability is stated in the provided data. The vendor advisory URL points to a Chrome stable channel update blog, which may contain further remediation details.

The impact is limited to scenarios where an attacker has already compromised the renderer process, enabling them to bypass the same origin policy via crafted HTML content. This could potentially allow unauthorized access to resources or data across origins within the browser context. However, the severity is rated low, indicating limited risk or difficulty in exploitation. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for current remediation guidance. Since the affected version is prior to 149.0.7827.53, updating Google Chrome to version 149.0.7827.53 or later is recommended once the vendor confirms the fix. No other specific mitigations are provided in the advisory.