An authorization flaw in Chrome’s SiteIsolation architecture allows an attacker to execute arbitrary code on a victim’s machine by serving a specially crafted HTML page. The vulnerability hinges on insufficient checks before granting site isolation permissions, enabling a malicious site to bypass security boundaries and run arbitrary scripts. The impact is severe because an attacker who can deliver the crafted page can take full control of the browser context and potentially the underlying operating system.

The issue affects Google Chrome versions prior to 155.0.8059.39. All Chrome deployments using an older stable channel are vulnerable until the 155.0.8059.39 update or later is installed. The vulnerability is tied specifically to the Chrome browser and does not affect other Google products.

Chromium security team rated the vulnerability with a CVSS score of 9.6, which falls into the High severity category, and no EPSS score is available, so the precise exploit probability remains unknown. The vulnerability is listed as not in the CISA KEV catalog, suggesting no publicly known exploits at this time. Nonetheless, because the attack vector is a remote crafted HTML page that can be served over the web, the potential for exploitation is significant for users who visit untrusted sites or receive malicious emails containing such pages. Until patched, the flaw poses a high risk of remote code execution.