This vulnerability arises from inadequate validation of untrusted input in the New Tab Page component of Google Chrome versions prior to 149.0.7827.103. An attacker with control over the renderer process could exploit this to leak data across origins by using a specially crafted HTML page. The issue is recognized as high severity by the Chromium security team. No CVSS score or detailed remediation information is included in the provided data. The vulnerability affects the desktop version of Google Chrome and is publicly disclosed as of June 8, 2026.

The impact involves potential leakage of cross-origin data if an attacker has already compromised the renderer process. This could lead to unauthorized disclosure of sensitive information accessible within the browser context. There are no reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html for current remediation guidance. Users and administrators should monitor official Google Chrome release notes and update to the latest stable version once a fix is confirmed available.