This vulnerability arises from an inappropriate CSS implementation in Google Chrome versions before 150.0.7871.47. It enables a remote attacker to leak cross-origin data by crafting a malicious HTML page. The issue is classified under CWE-200 (Exposure of Sensitive Information). The CVSS 3.1 base score is 6.5, reflecting a network attack vector with low attack complexity, no privileges required, user interaction needed, unchanged scope, and high confidentiality impact without affecting integrity or availability. The vendor advisory link is available but does not explicitly state if the issue is fixed in the referenced version or if a patch is available.

The vulnerability allows unauthorized disclosure of sensitive cross-origin data, compromising confidentiality. There is no impact on data integrity or system availability. Exploitation requires user interaction and can be performed remotely over the network.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html for current remediation guidance. Until confirmation, users should consider updating to the latest Chrome version once available and exercise caution when visiting untrusted websites.