This vulnerability in Google Chrome on Android arises from an inappropriate implementation in the Network component that permits a remote attacker, with prior control over the renderer process, to bypass site isolation protections via a crafted HTML page. The vulnerability is identified as CWE-346 (Inadequate Verification of Data Authenticity). The CVSS v3.1 base score is 6.5 (medium severity), with attack vector network, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact. The affected versions are those prior to 150.0.7871.47. No vendor advisory explicitly states the patch status, and no official remediation level is provided. The vendor advisory URL is available but does not confirm patch availability.

An attacker who has already compromised the renderer process can exploit this vulnerability to bypass site isolation, potentially allowing them to interfere with the integrity of web content from other sites. There is no impact on confidentiality or availability. This could facilitate further attacks or data manipulation within the browser context.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html for current remediation guidance. Until an official fix is confirmed, users should exercise caution with untrusted content and consider updating to version 150.0.7871.47 or later once available.