The vulnerability is an incorrect authorization in Chrome’s SiteIsolation component, reflecting a CWE‑125 out‑of‑bounds read and a CWE‑863 missing access control. A remote attacker who has compromised the renderer process can bypass site isolation by loading a crafted HTML page, enabling access to data from other isolated sites and potentially leading to information disclosure and further exploitation. Chromium classifies this issue as a medium‑severity problem.

The flaw affects Google Chrome on all platforms running the desktop stable channel prior to version 156.0.8078.47. Any installation with a lower version number is vulnerable, while versions 156.0.8078.47 and newer contain the fix. The platform scope is not explicitly listed in the advisory; it is inferred that every platform supporting the desktop stable channel is impacted.

A remote attacker must entice a user to load a crafted HTML page while the vulnerable browser is active. Because the fault is a read primitive limited to the sandboxed renderer, code execution is not achieved directly. The flaw also represents a classic missing access control (CWE‑863) that permits the renderer to read data belonging to other isolated sites. The EPSS score is <1%, and the CVSS score of 6.5 indicates medium severity. The vulnerability is not listed in the KEV catalog. The medium severity and realistic web‑based attack vector imply a non‑negligible risk for users of the affected versions. It is inferred that successful exploitation requires user interaction to load malicious content.