CVE-2026-95375 is an authorization flaw in the BrowserTag feature of Google Chrome before version 154.0.8037.57. It enables a remote attacker, with control over the renderer process, to bypass the web origin policy by using a specially crafted HTML page. This vulnerability compromises the browser's security model that isolates web content by origin. The issue has been publicly disclosed and patched by Google in the stable channel update 154.0.8037.57.

Successful exploitation allows an attacker who has already compromised the renderer process to bypass the web origin policy, potentially enabling unauthorized access to web content from different origins. This undermines the browser's security boundary between websites, possibly leading to data leakage or unauthorized actions within the browser context. The severity is rated medium by the Chromium security team.

Users should update Google Chrome to version 154.0.8037.57 or later, where this vulnerability has been fixed. No additional mitigation steps are required as the official fix addresses the issue.