The vulnerability lies in the handling of extensions in Google Chrome prior to revision 149.0.7827.115. A remote attacker who has already compromised the renderer process can craft a malicious HTML page that allows the attacker to bypass site isolation barriers, thereby accessing or manipulating content from multiple sites. This undermines the browser’s security boundary and could lead to data leakage or credential theft.

Affected across all installations of Google Chrome that are older than revision 149.0.7827.115, including Windows, macOS, Linux, ChromeOS, and Android/iOS. The issue was identified in the stable channel and affects any user who has not applied the latest update.

The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. The severity is classified as high. An attacker would need to have already gained control of the renderer process, which typically requires exploitation of another flaw or a user‑enabled configuration. Once that foothold is achieved, the crafted HTML page can bypass site isolation without additional privileges. Because the window of opportunity relies on a pre‑existing compromise, the likelihood of direct exploitation remains moderate but is non‑negligible for high‑value targets.