This vulnerability involves an inappropriate implementation in the Isolated Web Apps feature of Google Chrome before version 151.0.7922.72. It permits a remote attacker to bypass navigation restrictions via a crafted HTML page, potentially leading to limited confidentiality, integrity, and availability impacts. The CVSS v3.1 base score is 6.3, indicating medium severity, with attack vector network, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability.

An attacker can remotely bypass navigation restrictions in Chrome's Isolated Web Apps, which may lead to unauthorized actions or information disclosure within the context of these apps. The impact is limited to low confidentiality, integrity, and availability loss as per the CVSS score. No active exploitation has been reported.

The vulnerability affects versions prior to 151.0.7922.72. Users and administrators should update Google Chrome to version 151.0.7922.72 or later to remediate this issue. The vendor advisory is available at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Patch status is not explicitly confirmed in the advisory content provided here, but the presence of a fixed version implies that updating to 151.0.7922.72 addresses the vulnerability.