This vulnerability arises from insufficient enforcement of security policies in the ViewTransitions API in Google Chrome versions before 148.0.7778.168. Exploitation involves a remote attacker crafting an HTML page that can bypass same-origin restrictions to leak data from other origins. The issue was publicly disclosed on May 14, 2026, with a high severity rating by Chromium. The vendor advisory URL points to a stable channel update announcement but does not explicitly state whether this vulnerability is fixed in that update.

The impact is a potential cross-origin data leak, which can compromise user privacy and confidentiality by exposing data from other origins to an attacker-controlled page. There are no known exploits in the wild at the time of disclosure.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html for current remediation guidance. Users and administrators should update Google Chrome to the latest stable version once confirmation of the fix is available. Until then, no specific mitigation steps are provided by the vendor advisory.