Technical impact
In the ORB component of Google Chrome prior to 149.0.7827.53, an inappropriate implementation allows a remote attacker to craft an HTML page that bypasses the browser’s site isolation safeguards. The vulnerability creates a gap in the separation that Chrome enforces between distinct web origins so that, once bypassed, the attacker could potentially access information or resources from other isolated contexts. Based on the description, it is inferred that this breach could enable the attacker to exploit data or functionality that was intended to be segregated by site isolation.
Affected Systems
Google Chrome for desktop operating systems running any version before 149.0.7827.53. Users on the stable channel who have not yet installed the latest update are at risk.
Risk and Exploitability
The likely attack vector is remote; the attacker must host or serve a specially crafted HTML page that the victim will open. The EPSS score is less than 1%, and the vulnerability is not listed in the CISA KEV catalog, indicating a low or uncertain likelihood of exploitation. The CVSS score is 8.8, indicating a high severity. The potential impact of bypassing site isolation remains significant, as it could undermine Chrome’s core security model and allow the attacker to exfiltrate data or execute privileged actions across origins.
Debian DSA