This vulnerability arises from insufficient enforcement of security policies in the ServiceWorker implementation of Google Chrome versions before 148.0.7778.179. An attacker can exploit this weakness by crafting a malicious HTML page that causes cross-origin data leakage. The CVSS score of 4.3 reflects a network attack vector with low complexity, no privileges required, but user interaction needed, and limited confidentiality impact. The vulnerability is categorized under CWE-693 (Protection Mechanism Failure).

An attacker can remotely cause leakage of cross-origin data, potentially exposing sensitive information from other origins accessible within the browser context. There is no impact on data integrity or system availability. The confidentiality impact is limited, and no known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0841193308.html for current remediation guidance. Users and administrators should monitor this advisory for updates and apply any official fixes once available. Until then, exercising caution with untrusted web content and limiting user interaction with suspicious pages may reduce risk.