This vulnerability arises from insufficient enforcement of WebAuthentication policies in Google Chrome on Android before version 149.0.7827.53. An attacker with control over the renderer process can exploit this weakness to leak data across origins via a specially crafted HTML page. The issue is limited to scenarios where the renderer process is already compromised, reducing the scope of direct exploitation. The Chromium security team classifies this as a low severity issue. No detailed remediation or patch information is provided in the vendor advisory link.

The impact is limited to data leakage of cross-origin information when the renderer process is compromised. This does not represent a remote code execution or privilege escalation by itself but could aid an attacker in gathering sensitive data from other origins within the browser context. The severity is considered low by the Chromium security team, indicating limited risk under normal threat conditions.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for current remediation guidance. Users should update to Chrome version 149.0.7827.53 or later once available. Until then, no specific mitigation steps are detailed by the vendor.