This vulnerability in Google Chrome's PDF handling arises from insufficient data validation, enabling an attacker with control over the renderer process to bypass navigation restrictions via a specially crafted HTML page. The issue affects versions before 150.0.7871.47. The CVSS 3.1 base score is 6.5 (medium), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact. The vendor advisory linked does not explicitly confirm patch availability or remediation level.

An attacker who has already compromised the renderer process can exploit this vulnerability to bypass navigation restrictions, potentially leading to unauthorized actions or integrity violations within the browser context. There is no direct confidentiality or availability impact reported. No known active exploitation has been observed.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html for current remediation guidance. Until official confirmation, users should update to version 150.0.7871.47 or later if available, as this version is indicated as the fixed version. No additional mitigation steps are specified.