This vulnerability in Google Chrome's Navigation implementation allows a remote attacker with control over the renderer process to leak cross-origin data by crafting a malicious HTML page. The issue affects versions prior to 147.0.7727.55. The CVSS score is 4.3 (medium severity) with an attack vector of network, low attack complexity, no privileges required, user interaction required, and only confidentiality impact. The vulnerability relates to CWE-352 (Cross-Site Request Forgery) and CWE-346 (Origin Validation Error). The vendor advisory is available but does not explicitly state patch or remediation details.

An attacker who has compromised the renderer process can leak cross-origin data, potentially exposing sensitive information from other origins. There is no impact on integrity or availability. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.html for current remediation guidance. Until confirmed, users should update to version 147.0.7727.55 or later if available. No additional mitigation steps are specified by the vendor.