The vulnerability arises from improper input validation in Chrome’s compositing component prior to version 156.0.8078.47. A remote attacker who has already compromised the renderer process can deliver a crafted HTML page that bypasses site isolation because of a flaw in how content is processed. The bypass can undermine the separation between rendering processes and allow the attacker to influence content that should remain isolated.

Google Chrome for desktop browsers before version 156.0.8078.47 are affected. Any user running these releases is vulnerable to the described bypass of site isolation.

Despite the EPSS score of <1% and absence from the CISA KEV catalog, the CVSS score of 8.8 signals high severity. Exploitation requires a pre‑compromised renderer, after which the attacker serves a crafted page that triggers the input validation defect to bypass site isolation. This can lead to the violation of process boundaries and potentially allow further privilege escalation within the browser.