The vulnerability is an incorrect authorization flaw (CWE-863) in CacheStorage in Google Chrome prior to version 157.0.8103.38 that allows a remote attacker who has already compromised the renderer process to bypass Chrome’s site isolation, permitting access to data that should be segregated between distinct web origins.

Google Chrome versions earlier than 157.0.8103.38 are affected.

The CVSS score is not available and the vulnerability is not listed in CISA’s KEV catalog; Chromium categorises the issue as Medium severity. Exploitation requires that an attacker already controls the renderer process, which could result from malicious web content or phishing. The likely attack vector involves an attacker delivering a crafted HTML page to a user while the renderer is compromised, enabling the bypass of site isolation to facilitate cross‑origin data access.