The vulnerability stems from insufficient enforcement of policy rules on Chrome extensions, allowing an extension that a user has installed to bypass the browser’s Site Isolation protection. This breach permits the attacker to gain elevated privileges within the browser context, potentially accessing data and credentials that should be isolated between sites, thereby compromising user confidentiality and session integrity.

Chrome desktop users running any version prior to 149.0.7827.53 are affected. The patch to address this issue is released in the June 2026 update to the stable channel of Google Chrome.

Chromium rates the flaw as Medium severity; a CVSS score is not listed publicly. No EPSS score is available and the vulnerability is not cataloged in the CISA KEV list. The attack requires social engineering to convince a user to install a malicious extension, after which the hardened site isolation can be bypassed. Once the malicious extension runs, it can interact with isolated site contexts, compromising confidentiality and data integrity.