This vulnerability involves a content security policy (CSP) bypass in Google Chrome versions before 149.0.7827.53 due to improper implementation of Permissions. A remote attacker could exploit this by delivering a crafted HTML page that circumvents CSP protections designed to restrict resource loading and script execution. The issue is identified as low severity by Chromium security. No CVSS score or detailed exploitation information is provided. The vendor advisory URL is available but does not explicitly state patch or remediation details.

The impact is a potential bypass of content security policy protections, which could allow an attacker to execute or load unauthorized content in the browser context. However, the severity is rated low, indicating limited risk or difficulty in exploitation. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for current remediation guidance. Users should update to Chrome version 149.0.7827.53 or later once confirmed. Until then, no specific mitigation steps are provided by the vendor.