Improper input validation in the Downloads component of Google Chrome permits an attacker who has already compromised the renderer process to bypass site isolation by serving a specially crafted HTML page. The flaw allows the attacker to escape the intended site isolation boundary within the renderer, potentially facilitating privilege escalation or cross-site data access. This indicates an input validation weakness, identified as CWE-20 (Chromium security severity: Medium).

The vulnerability affects all desktop versions of Google Chrome running the stable channel before release 156.0.8078.47. Users on Windows, macOS, Linux, and other supported operating systems whose browsers have not yet updated to 156.0.8078.47 or later are vulnerable. The affected releases include any earlier stable channel builds that performed downloads of arbitrary web content.

With a CVSS score of 8.8, the vulnerability is considered High severity. The EPSS score is 0.00443 (<1%), indicating a low but non‑zero probability of exploitation, and the flaw is not listed in the CISA Known Exploited Vulnerabilities catalog. Attackers can exploit the flaw remotely by luring a user to a malicious web page or file that triggers the flawed Downloads handling. The exploit requires no special privileges and can be achieved through normal user interaction, making it reasonably likely to be used in the wild. Updating to Chrome 156.0.8078.47 or a later version permanently removes this flaw.