This vulnerability arises from improper XML implementation in Google Chrome versions before 150.0.7871.47, enabling remote attackers to perform UXSS attacks by injecting arbitrary scripts or HTML via crafted HTML pages. The CVSS score of 6.1 reflects a network attack vector with low attack complexity, no privileges required, but user interaction needed, and impacts confidentiality and integrity with no availability impact. The vulnerability is categorized under CWE-79 (Improper Neutralization of Input During Web Page Generation). The vendor advisory URL is provided but does not explicitly state the availability of a patch or fix.

Successful exploitation allows remote attackers to inject arbitrary scripts or HTML content into the browser context, potentially leading to unauthorized actions or data exposure within the affected user's browsing session. The impact affects confidentiality and integrity but does not affect availability. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html for current remediation guidance. Users and administrators should update to version 150.0.7871.47 or later once confirmed patched. Until then, exercise caution with untrusted HTML content and consider applying any recommended temporary mitigations from the vendor advisory.