The vulnerability is a missing authorization flaw in Chrome’s SiteIsolation feature that affects versions prior to 156.0.8078.47. A remote attacker who has already compromised the renderer process can bypass site isolation by loading a crafted HTML page, thereby gaining the same privileges that the browser process has. This allows the attacker to potentially compromise the user’s machine by accessing data or resources that are normally separated by origin boundaries.

Google lists Chrome 156.0.8078.47 and earlier as vulnerable.

The CVSS score of 8.8 indicates a high severity. The EPSS score of < 1% shows a very low likelihood of exploitation currently, and it is not listed in the CISA KEV catalogue. The flaw can be triggered by delivering a malicious HTML page that leads the compromised renderer process to bypass site isolation, allowing the attacker to gain privileges equivalent to the browser process. The attack vector requires the attacker to already have compromised the renderer process.