This vulnerability in Google Chrome's Permissions implementation allows remote attackers to bypass the same origin policy by using a specially crafted HTML page. The flaw affects versions prior to 151.0.7922.72 and is classified under CWE-346 (Origin Validation Error). The CVSS 3.1 base score is 6.5, indicating a medium severity with network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact. The vendor advisory indicates a stable channel update for desktop Chrome that includes the fix.

Successful exploitation allows an attacker to bypass the same origin policy, potentially enabling unauthorized actions that compromise the integrity of web content or user interactions. Confidentiality and availability are not impacted. This could lead to unauthorized modification or manipulation of web resources within the browser context.

A fix is available in Google Chrome version 151.0.7922.72. Users and administrators should update to this version or later to remediate the vulnerability. The vendor advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html provides official update details.