This vulnerability involves an inappropriate implementation in the FedCM component of Google Chrome versions before 151.0.7922.72. It enables a remote attacker to bypass the same origin policy by using a specially crafted HTML page. The same origin policy is a critical security mechanism that restricts how documents or scripts loaded from one origin can interact with resources from another origin. Bypassing this policy can lead to unauthorized integrity modifications within the browser context. The CVSS vector indicates the attack requires no privileges and user interaction but can be executed remotely with low attack complexity.

The vulnerability allows a remote attacker to bypass the same origin policy, potentially leading to unauthorized integrity changes in the browser environment. There is no direct impact on confidentiality or availability. No active exploitation in the wild has been reported.

The vendor advisory linked (https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html) should be consulted for the latest update status. Since the vulnerability affects versions prior to 151.0.7922.72, updating to version 151.0.7922.72 or later is recommended if confirmed by the vendor advisory. Patch status is not explicitly confirmed in the provided data; therefore, users should verify the update availability and apply the official fix once confirmed.