An improper implementation in Chrome’s Fenced Frames component allows a malicious actor who has already compromised the renderer process to bypass the browser’s site isolation boundary using a specially crafted HTML page. This flaw, classified as CWE-346 and CWE-653, enables the attacker to access or manipulate web pages from different origins that should remain isolated, thereby undermining the isolation guarantees that protect user data and content integrity. The vulnerability does not provide direct code execution but elevates the attacker’s privileges within the browser context.

Google Chrome versions earlier than 149.0.7827.53 are affected. No other vendors or products are reported as vulnerable.

The CVSS score is 6.5 and the EPSS probability is less than 1 %. The flaw is not listed in the CISA KEV catalog. Exploitation requires the attacker to have taken control of a renderer process and to deliver a crafted page. While the likelihood of a real‑world attack remains low, the ability to break out of site isolation is a significant concern, especially in environments where sensitive information is rendered in the browser.