This vulnerability arises from insufficient validation of untrusted input in the StorageAccessAPI component of Google Chrome before version 150.0.7871.47. An attacker who has already compromised the renderer process can exploit this flaw to leak cross-origin data by crafting a malicious HTML page. The issue is categorized under CWE-20 (Improper Input Validation). The CVSS v3.1 base score is 6.5, indicating a medium severity with network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high confidentiality impact.

Successful exploitation allows an attacker with control over the renderer process to leak sensitive cross-origin data, compromising confidentiality. There is no impact on integrity or availability. The vulnerability requires user interaction and does not require privileges, making it moderately exploitable in scenarios where the renderer process is compromised.

The vendor advisory linked does not explicitly state the availability of a patch or remediation level. Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html for current remediation guidance. Until a fix is confirmed, users should exercise caution with untrusted content and consider updating to the latest Chrome version once the patch is released.