This vulnerability arises from insufficient policy enforcement in Cross-Origin Resource Sharing (CORS) within Google Chrome versions prior to 147.0.7727.101. An attacker with control over the renderer process can exploit this weakness to leak data across origins by delivering a specially crafted HTML page. The issue is recognized by Chromium security as high severity. The vulnerability was published on April 15, 2026, but no CVSS score or explicit remediation level is provided in the data. The vendor advisory is available but does not explicitly confirm patch availability in the provided content.

The impact is that an attacker who has already compromised the renderer process in Chrome can bypass CORS policy enforcement to leak sensitive cross-origin data. This could lead to unauthorized data disclosure within the browser context. There are no reports of active exploitation in the wild. The vulnerability affects Chrome versions prior to 147.0.7727.101.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop_15.html for current remediation guidance. Since this is a client-side vulnerability affecting Chrome, updating to the latest stable version of Chrome is recommended once a fix is confirmed available. No other specific mitigations are indicated in the provided data.