Google Chrome did not properly validate untrusted HTML content loaded by extensions, meaning a malicious payload could be inserted into a renderer process that had already been compromised. An attacker who gains code execution in the renderer can exploit this flaw to circumvent site isolation and interact with web pages from other origins, potentially exfiltrating data or executing unauthorized scripts.

The vulnerability affects all desktop releases of Google Chrome prior to version 149.0.7827.103. It applies to the browser on Windows, macOS, and Linux and specifically impacts extensions that load external HTML content.

The CVSS score of 6.5 categorizes the flaw as medium severity. Because exploitation requires the attacker to first compromise the renderer process, the overall risk depends on establishing such a foothold. The EPSS score of <1% indicates a low probability of exploitation in the general population, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, a successful renderer compromise leads to a breach of site isolation and cross‑origin data exposure.