An incomplete cleanup in Chrome’s Extension component before version 156.0.8078.47 permits a remote attacker who has already compromised the renderer process to bypass site isolation by loading a specially crafted HTML page. This flaw exploits memory handling weaknesses (CWE-125 and CWE-459) and can allow the attacker to access data or execute code in a higher‑privilege context that should otherwise be contained by the browser’s isolation mechanisms.

The affected product is Google Chrome. Versions prior to 156.0.8078.47 are vulnerable. Users running older Chrome releases are at risk if they install extensions that process untrusted web content.

The flaw can be exploited remotely by a malicious web page that contains crafted content. If the attacker has already compromised the renderer process, the vulnerability allows bypassing site isolation, enabling access to data from other sites or higher‑privilege execution within the browser. The EPSS score of less than 1% indicates a low probability of exploitation. The CVSS score of 6.5 reflects medium severity, and the Chromium team rated the issue as medium. Since it is not listed in the CISA KEV catalog, no widespread exploitation is currently documented.