An absence of authorization in the Workers API used by Chrome's renderer process allows a remote attacker who has already compromised that process to bypass Chrome's site isolation protection. The attacker can supply a specially crafted PDF file that triggers the vulnerable code path, potentially exposing data or executing code across site boundaries. This flaw falls under CWE-862, which describes a missing authorization check.

Google Chrome browsers with versions prior to 155.0.8059.39 are affected. Updated releases beyond 155.0.8059.39 contain the fix.

The vulnerability has a CVSS score of 8.1, indicating high severity, and is not listed in the CISA KEV catalog. The EPSS score is <1%, suggesting a low probability of exploitation. The requirement of a renderer compromise means that exploitation is unlikely to occur without an initial foothold. The attack vector is inferred to be a malicious PDF delivered to a user; the lack of an authorization check allows the attacker to cross site isolation boundaries once renderer access is achieved.