A use‑after‑free flaw in Chrome’s SiteIsolation module permits a malicious renderer process to corrupt internal UI state. By delivering a specially crafted HTML page, an attacker can cause the browser to render a falsified address bar, misleading users about the true origin of the content. This deception enables phishing attacks and is identified as CWE‑451. The vulnerability does not provide arbitrary code execution, but its exploitation undermines user trust and can facilitate credential theft.

All Google Chrome browsers that use SiteIsolation and run a version earlier than 156.0.8078.47 are affected. It is unclear from the CVE data whether SiteIsolation is enabled by default on the stable channel; affected installations may be those that have SiteIsolation enabled.

The CVSS score of 8.8 reflects a high severity, while the EPSS score of less than 1% indicates a low likelihood of public exploitation at present. The vulnerability is not listed in CISA KEV. Exploitation requires the attacker to first compromise the renderer process, which is a higher‑level attack step. Once a renderer compromise is achieved, the memory error can be triggered simply by visiting a crafted page, making the attack path straightforward for a privileged adversary.