Technical impact
The vulnerability originates from insufficient validation of untrusted input in the WebAuthentication component of Google Chrome. This input validation weakness (CWE‑20) coupled with potential cross‑site scripting (CWE‑79) allows a crafted HTML page to bypass the same‑origin policy. The attacker, after compromising the renderer process, can read or interact with resources from a domain that would normally be disallowed, compromising confidentiality and potentially enabling further internal movement.
Affected Systems
Google Chrome versions earlier than 149.0.7827.53 are affected. The flaw exists in the stable channel and applies to Chrome running on Windows, macOS, and Linux. All users on those platforms should update to the June 2026 security release or later.
Risk and Exploitability
Chromium assigns this flaw a CVSS score of 3.1, reflecting low severity. The EPSS score is less than 1%, indicating that exploitation is unlikely and no public exploits are documented. The vulnerability requires that the attacker already has control of the renderer process; it cannot be triggered solely from a remote network connection. It is not listed in the CISA KEV catalog, further supporting a limited threat profile.
Debian DSA