This vulnerability involves a policy bypass in ServiceWorkers within Google Chrome before version 147.0.7727.55. Specifically, it enables a remote attacker to circumvent the content security policy (CSP) by delivering a crafted HTML page, potentially weakening the browser's security controls. The issue is tracked as CWE-693 and has a CVSS v3.1 base score of 4.3, reflecting a medium impact primarily on integrity with no confidentiality or availability impact. The vulnerability was publicly disclosed on April 8, 2026, and Google has issued a stable channel update announcement, though the exact remediation level is not explicitly stated in the advisory.

The vulnerability allows remote attackers to bypass content security policy restrictions via ServiceWorkers, which could lead to limited integrity impacts such as unauthorized script execution or content manipulation within the browser context. There is no impact on confidentiality or availability according to the CVSS vector. No known active exploitation has been reported.

Google has published a stable channel update for Chrome that presumably addresses this vulnerability. However, the exact patch status is not explicitly confirmed in the advisory provided. Users should update to Chrome version 147.0.7727.55 or later to ensure protection. Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.html for current remediation guidance.