Missing authorization controls in the Passwords component of Google Chrome for Android before 155.0.8059.39 allow a remote attacker who has already compromised the renderer process to bypass the browser’s site isolation feature through a specifically crafted HTML page. The vulnerability represents a broken access control flaw (CWE‑862) and may enable the attacker to interact with renderer contexts that are intended to remain isolated. This inference is based on the function of site isolation in separating web content.

Google Chrome for Android versions earlier than 155.0.8059.39 are affected. Devices running any of those builds, regardless of other security settings, could be vulnerable if an attacker manages to introduce a malicious renderer process through a crafted web page or exploit.

The exploit requires the attacker to already compromise the renderer process, making the initial foothold a prerequisite. The EPSS score of <1% indicates a very low probability of exploitation, and the issue is not listed in CISA KEV, suggesting no known large‑scale attacks. Nevertheless, the CVSS score of 8.1 signals a high severity, and because the flaw bypasses a core isolation mechanism, the potential impact is significant if exploitation occurs.