This vulnerability in Google Chrome's GuestView component arises from insufficient policy enforcement, enabling a remote attacker to leak cross-origin data by crafting a malicious HTML page. The issue affects versions of Chrome before 151.0.7922.72. The CVSS 3.1 base score is 4.3, reflecting low complexity and no required privileges but user interaction is needed. The vulnerability is classified under CWE-346 (Insufficient Authorization). No official fix or remediation level is stated in the available data, but a vendor advisory link is provided for further details.

An attacker can remotely cause information disclosure by leaking cross-origin data, compromising confidentiality. There is no impact on integrity or availability. The attack requires user interaction and no privileges, making it a moderate risk in terms of exploitation complexity.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html for current remediation guidance. Until official confirmation, users should apply updates promptly once available. No other specific mitigations are indicated by the vendor.