A missing authorization check in Google Chrome’s SiteIsolation feature allows a remote attacker who already compromises the renderer process to read sensitive information from a crafted PDF file. The flaw enables the malicious renderer to bypass normal security boundaries and access data that should be protected by the browser’s isolation mechanisms. This is a data leakage vulnerability that could expose user information, cookies, or other confidential data that the renderer is permitted to read.

All Google Chrome installations running a version prior to 157.0.8103.38 are vulnerable. The issue was identified in the Chromium code before this release and is fixed in the new version. Users of earlier Chrome builds on Windows, macOS, Linux, and other supported platforms are potentially affected.

The vulnerability’s CVSS severity is Medium. EPSS data is not available, so its exploitation probability cannot be quantified. The flaw requires that an attacker has already achieved code execution or otherwise compromised the renderer process, which is a non‑trivial prerequisite. It is not listed in CISA’s KEV catalog, indicating no publicly known exploits have been observed yet. Cloud‑based or managed Chrome deployments that enforce strict policy controls on PDF handling will face reduced risk.