A flaw in Chrome extensions allows an attacker who has already compromised the renderer process to bypass the browser’s site isolation. The weakness is an insecure handling of input within the extensions code (CWE‑20), and was rated with high severity by Chromium security. If exploited, the attacker could read or manipulate data from other processes or web origins that should remain isolated, potentially leading to data theft or injection of malicious content.

Google Chrome desktop releases prior to version 149.0.7827.103 are affected.

The vulnerability requires an attacker to first obtain control over the renderer process, which could be achieved via a malicious extension or a compromised website. Once control is achieved, a crafted HTML page can be served to the renderer to lift it out of its isolated context. The EPSS score is not available, but the high Chromium severity and the need for pre‑existing renderer compromise suggest a moderate to high exploitation difficulty. The vulnerability is not listed in CISA KEV, indicating no publicly known exploits at the time of analysis.