Insufficient validation of untrusted input in the Loader component of Google Chrome before version 149.0.7827.53 allows a remote attacker who has already compromised the renderer process to bypass Chrome’s site isolation mechanism. The vulnerability can enable the attacker to read or impact content from other tabs or sites that are normally isolated. The Chromium security severity is reported as low, but the impact is significant if the attacker has foothold in the renderer.

Google Chrome versions earlier than 149.0.7827.53 are affected. The vulnerability is specific to the Loader module used during page parsing and rendering inside Google Chrome’s renderer process.

The exploit requires the attacker to already have control over the renderer process, a condition that typically results from a preceding vulnerability or compromise. No public exploit or published exploit code is known, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is not available. Despite the low Chromium severity rating, the ability to break isolation between processes makes this vulnerability more dangerous in a multi-tenant or shared environment, especially when combined with other flaws that allow renderer compromise.