This vulnerability arises from insufficient enforcement of security policies in the WebAuthentication component of Google Chrome on Android versions before 149.0.7827.53. An attacker with control over the renderer process can exploit this weakness to leak data across origins by crafting a malicious HTML page. The issue is classified under CWE-693 (Protection Mechanism Failure). Although the CVSS score indicates medium severity, the impact is limited to confidentiality loss without integrity or availability impact. The vendor advisory linked does not explicitly state a fix or remediation level, and no known exploits have been observed.

Successful exploitation allows a remote attacker who has already compromised the renderer process to leak sensitive cross-origin data. This compromises confidentiality but does not affect integrity or availability. The vulnerability is limited to affected versions of Chrome on Android prior to 149.0.7827.53.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for current remediation guidance. Until an official fix is confirmed, users should exercise caution with untrusted content and consider updating to the latest Chrome version once available.