The vulnerability originates from an inappropriate implementation in the input handling of Google Chrome versions older than 149.0.7827.53. An attacker who has already compromised the renderer process can craft a malicious HTML page that overrides the browser's site isolation feature. The flaw is identified as input validation error (CWE‑20) and untrusted input processing issue (CWE‑501) and is rated as high severity by Chromium security.

Affected systems are Google Chrome browsers that run on the stable channel, specifically all releases before 149.0.7827.53. The issue exists across all operating system variants supported by Chrome, as the renderer component is shared. No version numbers beyond the affected threshold are known to be vulnerable.

The attack requires a foothold in the renderer process, which typically demands a prior compromise or advanced local exploitation. The EPSS score of < 1% indicates a very low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog, indicating that widespread exploitation has not yet been documented. Nevertheless, the high severity rating with a CVSS score of 8.1 and the fact that bypassing site isolation can expose private data or allow cross-site data leaks suggest that the risk warrants prompt attention when the necessary update is available.