This vulnerability arises from an improper implementation of Cross-Origin Resource Sharing (CORS) in Google Chrome versions before 148.0.7778.168 on Linux and ChromeOS. Exploiting this flaw, a remote attacker can cause leakage of cross-origin data by delivering a specially crafted HTML page. The issue is recognized by Chromium security as medium severity. No CVSS score or detailed remediation information is provided in the input data. The vendor advisory URL points to a stable channel update announcement but does not explicitly state if this vulnerability is fixed in that update.

The impact is limited to potential leakage of cross-origin data, which can compromise confidentiality of information accessible via the browser. This could allow attackers to access data from other origins that should be protected by CORS policies. There are no known exploits in the wild reported at this time.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html for current remediation guidance. Users should update to version 148.0.7778.168 or later once confirmed. Until then, no specific mitigation steps are provided by the vendor advisory.