This vulnerability is found in Google Chrome before version 154.0.8037.92. The issue resides in the SiteIsolation component, where an attacker who can compromise a renderer process can use a crafted HTML page to bypass the browser’s web origin policy. The wrong authorization permits the attacker to access or modify resources across origins, potentially exposing sensitive data or executing malicious scripts from another site. The flaw is categorized as CWE‑346 and CWE‑863.

The affected product is Google Chrome on all supported platforms (Windows, macOS, Linux) running versions earlier than 154.0.8037.92.

The CVSS score of 6.5 indicates a medium severity impact, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score of 0.00225 indicates a very low probability of exploitation, though the requirement that the attacker already compromise the renderer process further reduces the likelihood. Based on the description, it is inferred that a remote attacker could deliver a crafted HTML page to a user who has a vulnerable Chrome installation. Once the renderer is compromised, the origin boundaries can be subverted, enabling potential data exfiltration or cross‑origin attacks.