The vulnerability stems from insufficient enforcement of policy rules on Chrome extensions, allowing an extension that a user has installed to bypass the browser’s Site Isolation protection. This breach permits the attacker to gain elevated privileges within the browser context, potentially accessing data and credentials that should be isolated between sites, thereby compromising user confidentiality and session integrity.

Chrome desktop users running any version prior to 149.0.7827.53 are affected. The patch to address this issue is released in the June 2026 update to the stable channel of Google Chrome.

Chromium rates the flaw as Medium severity; the CVSS score is 6.5. The EPSS score is < 1% and the vulnerability is not cataloged in the CISA KEV list. Based on the description, it is inferred that the attacker must first convince a user to install a malicious extension, after which the hardened site isolation can be bypassed. Once the malicious extension runs, it can interact with isolated site contexts, compromising confidentiality and data integrity.