This vulnerability involves an inappropriate implementation in Google Lens within Google Chrome versions before 149.0.7827.53. It enables remote attackers to bypass navigation restrictions through a specially crafted HTML page. The issue is classified under CWE-693, which relates to protection mechanism failures. The CVSS 3.1 base score is 8.8, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability. The vendor advisory link is provided but does not explicitly confirm patch availability or remediation details.

Successful exploitation allows remote attackers to bypass navigation restrictions, potentially leading to unauthorized access or manipulation of web navigation flows. The vulnerability impacts confidentiality, integrity, and availability of affected systems as indicated by the CVSS score. No active exploits have been reported, but the high severity suggests significant risk if exploited.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for current remediation guidance. Until official confirmation, users should consider updating to the latest Chrome version once available and exercise caution with untrusted HTML content that could exploit this vulnerability.