The flaw resides in the handling of password functionality in Google Chrome on Android. A renderer process that has been compromised can craft a specialized HTML page that bypasses site isolation. This bypass removes the intended process and memory separation between sites, allowing the malicious party to access restricted data or perform actions that normally would be confined. Chromium labels the issue as high severity, indicating significant impact on confidentiality and integrity.

Google Chrome for Android versions prior to 149.0.7827.115 are affected. The vulnerability arises from in‑place implementation decisions rather than patched versions along the upgrade path.

Direct exploitation requires a prior render process compromise, which can occur through malicious content served to the user or via an attacker‑controlled app. Once a renderer is compromised, the attacker can serve a crafted page to unlock site isolation. No EPSS data is reported, and the issue is not listed in CISA’s KEV catalog, suggesting that public exploitation evidence is currently lacking. However, the high Chromium severity and the critical nature of site isolation mean that the risk of exploitation is non‑trivial for at‑risk users.