Missing authorization in Chrome’s site isolation allowed a remote attacker who had compromised a renderer process to bypass the isolation boundary with a crafted HTML page, potentially letting the attacker access data and resources from other sites. The flaw is a classic missing authorization weakness (CWE‑862) and also represents an improper control over cross‑site interactions (CWE‑653).

The vulnerability affects Google Chrome versions prior to 155.0.8059.39 on desktop platforms. Users running any earlier stable release are susceptible until an update is installed.

The official severity is medium, EPSS score of < 1% indicates a low likelihood of exploitation, and the vulnerability is not currently listed in CISA KEV. Because the exploit requires a renderer process that has already been compromised, the attack vector is not a simple remote code execution from the internet, but it still enables cross‑site data leakage and other privileged actions. Without a patch, an attacker who can hijack a renderer could escape site isolation constraints and potentially read or modify information from other web pages loaded in the same browser instance.