This vulnerability in Google Chrome's StorageAccessAPI prior to version 150.0.7871.47 allows a remote attacker with control over the renderer process to bypass policy enforcement and leak cross-origin data through a specially crafted HTML page. The issue stems from insufficient validation of untrusted input. The vulnerability is classified as medium severity by Chromium security. No CVSS score or detailed remediation level is provided in the available data. The vendor advisory link points to a stable channel update announcement but does not explicitly confirm patch status.

An attacker who has already compromised the renderer process can exploit this vulnerability to leak data across origins, potentially exposing sensitive information. The impact is limited to scenarios where the renderer process is compromised, and the attacker can deliver a crafted HTML page to trigger the data leak. This could lead to privacy violations or information disclosure.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html for current remediation guidance. Users should update to version 150.0.7871.47 or later once confirmed as fixed. No other specific mitigations are provided.