This vulnerability in Google Chrome's CORS handling allows insufficient validation of untrusted input, enabling a remote attacker with control over the renderer process to bypass the same origin policy via a crafted HTML page. The affected versions are prior to 148.0.7778.96. The issue was publicly disclosed on May 6, 2026. The vendor advisory is available but does not explicitly state patch or remediation details. The vulnerability is rated medium severity by Chromium security but lacks a CVSS score.

If exploited, this vulnerability could allow an attacker who has already compromised the renderer process to bypass the same origin policy, potentially leading to unauthorized access to resources or data that should be restricted by origin. However, exploitation requires prior compromise of the renderer process, limiting the scope of impact. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html for current remediation guidance. Until official confirmation of a fix is available, users should consider updating to the latest Chrome version once released. No specific mitigations are detailed in the advisory at this time.