This vulnerability in Google Chrome versions before 148.0.7778.179 arises from insufficient validation of untrusted input within the browser's renderer process. An attacker who has already compromised the renderer process can exploit this flaw to leak cross-origin data by using a specially crafted HTML page. The CVSS score is 5.3 (medium severity) with network attack vector, high attack complexity, no privileges required, user interaction required, unchanged scope, and high confidentiality impact. No integrity or availability impact is noted. The vendor advisory is available but does not explicitly confirm patch availability or remediation level.

The vulnerability allows an attacker with control over the renderer process to leak sensitive cross-origin data, potentially exposing confidential information. It does not affect system integrity or availability. No known exploits are reported in the wild, reducing immediate risk.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0841193308.html for current remediation guidance. Until confirmation, users should update to the latest Chrome version when available and exercise caution with untrusted web content. No official fix or temporary workaround is explicitly stated in the provided advisory.