This vulnerability arises from an inappropriate implementation in the Input component of Google Chrome on Android versions before 150.0.7871.47. It enables a remote attacker with control over the renderer process to leak sensitive cross-origin data by exploiting the object lifecycle issue through a crafted HTML page. The issue is classified under CWE-200 (Information Exposure) and has a CVSS 3.1 base score of 6.5, indicating a medium severity. There is no explicit vendor advisory detailing a patch or fix, but a Google Chrome stable channel update blog is referenced for further information.

An attacker who has already compromised the renderer process can exploit this vulnerability to leak sensitive cross-origin data, potentially exposing confidential information from other origins. The vulnerability does not affect integrity or availability but impacts confidentiality. There are no known exploits in the wild at the time of this report.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html for current remediation guidance. Until an official fix is confirmed, users should exercise caution with untrusted content and consider updating to the latest Chrome version once available.