This vulnerability (CVE-2026-7979) affects Google Chrome versions before 148.0.7778.96. It is caused by an inappropriate implementation in the Media subsystem that enables a remote attacker to leak cross-origin data by delivering a specially crafted HTML page. The CVSS 3.1 base score is 4.3 (medium), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and limited confidentiality impact. The vulnerability is categorized under CWE-346 (Origin Validation Error). The vendor advisory is available but does not explicitly state if a patch or fix has been released.

The impact is limited to confidentiality loss through cross-origin data leakage. There is no impact on data integrity or system availability. The vulnerability requires user interaction and network access but no privileges, making it a moderate risk. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html for current remediation guidance. Until a patch is confirmed, users should exercise caution when visiting untrusted websites and avoid interacting with suspicious content that could trigger the vulnerability.