A remote attacker who has already compromised a Chrome renderer process can exploit an authorization bypass in the Translate feature to bypass Chrome's site isolation. The flaw allows the attacker to inject a crafted HTML page that causes the renderer to perform actions normally restricted to a different site, effectively allowing the attacker to bypass site isolation. The primary weakness is a missing authorization check (CWE-862).

Google Chrome versions prior to 155.0.8059.39 are vulnerable. The vulnerability is marked as high severity in Chromium's own assessment.

The exploit requires the attacker to have already compromised the renderer process, which is a significant prerequisite. Because the flaw is not remotely exploitable from a clean system, the overall usage risk is lower, but once the renderer is compromised the attacker can break site isolation. The EPSS score is < 1% and the CVSS score of 4.2 indicates a moderate severity vulnerability; the issue is not listed in the CISA KEV catalog, suggesting limited public exploitation data at this time.