This vulnerability in Google Chrome's Media component on Windows platforms prior to version 151.0.7922.72 allows an attacker with control over the renderer process to bypass the same origin policy. The same origin policy is a critical security mechanism that restricts how documents or scripts loaded from one origin can interact with resources from another origin. By exploiting this flaw via a crafted HTML page, an attacker could potentially access or manipulate content across origins that should otherwise be isolated. The issue was assigned CVE-2026-17846 and is rated medium severity by Chromium security. No CVSS score is provided. The vendor has published an advisory indicating a stable channel update addressing this issue.

The impact of this vulnerability is a bypass of the same origin policy, which could allow an attacker who has already compromised the renderer process to access or manipulate content from different origins. This could lead to unauthorized data access or cross-origin attacks within the browser context. However, exploitation requires prior compromise of the renderer process, limiting the scope of direct remote exploitation.

Google has released a stable channel update for Chrome version 151.0.7922.72 that addresses this vulnerability. Users and administrators should update affected Chrome installations on Windows to version 151.0.7922.72 or later to remediate this issue. Since this is a client-side application, patching is the primary mitigation. No additional vendor-recommended mitigations are indicated.