This vulnerability (CVE-2026-14059) arises from insufficient policy enforcement in the Related-Website-Sets feature of Google Chrome versions before 150.0.7871.47. It enables a remote attacker to leak cross-origin data by delivering a specially crafted HTML page. The issue is classified under CWE-693 (Protection Mechanism Failure). The CVSS 3.1 base score is 6.5, indicating a medium severity with network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, high confidentiality impact, and no impact on integrity or availability. The vendor advisory linked does not explicitly state if a patch is available or if the issue is mitigated.

The vulnerability allows remote attackers to bypass policy enforcement controls in Chrome's Related-Website-Sets feature, resulting in unauthorized cross-origin data leakage. This compromises confidentiality but does not affect integrity or availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html for current remediation guidance. Until official fixes are confirmed, users should exercise caution when visiting untrusted websites and consider updating to the latest Chrome version once available.