This vulnerability in Google Chrome's WebSockets implementation involves insufficient validation of untrusted input, enabling a remote attacker with control over the renderer process to bypass the same origin policy via a crafted HTML page. The issue affects Chrome versions prior to 147.0.7727.55. The CVSS 3.1 base score is 6.5 (medium severity) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N, indicating network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact. No known exploits are reported. The vendor advisory does not explicitly state if a fix is available.

The vulnerability allows an attacker who has compromised the renderer process to bypass the same origin policy, potentially leading to integrity violations such as unauthorized modification of data or actions within the browser context. Confidentiality and availability are not impacted. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.html for current remediation guidance. Until an official fix is confirmed, users should exercise caution with untrusted content and consider limiting exposure to potentially malicious web pages. No specific mitigation steps are provided by the vendor advisory at this time.