The vulnerability is an incorrect authorization flaw in Chrome’s extensions component that exists before release 156.0.8078.47. A remote attacker who has already breached the renderer process can use social engineering to trick users into installing a crafted extension, enabling the attacker to bypass Chrome’s site isolation. This escalation grants the attacker read access to memory within the sandbox, allowing leakage of data from other sites and potentially facilitating further attacks. The weakness is categorized as CWE‑863 (Incorrect Authorization).

The issue impacts all versions of Google Chrome older than 156.0.8078.47. Any installation of Chrome prior to this release is vulnerable until the user updates to the patched build.

The EPSS score is under 1%, indicating a low likelihood of immediate exploitation, yet the CVSS score of 6.5 reflects medium severity. The vulnerability is not listed in the CISA KEV catalog. An attacker already controlling the renderer process can deploy a malicious extension through social engineering to bypass site isolation and read sandboxed memory. No publicly known exploits exist, but the flaw permits a crafted payload, so applying the patch is advised.