The flaw resides in Chrome’s extension handling. An attacker who controls the renderer process can craft a malicious HTML page that bypasses Chrome’s site‑isolation boundary, allowing access to data or resources that should be isolated. This can result in privilege escalation from the browser context to potentially wider system compromise.

The issue affects Google Chrome versions prior to 149.0.7827.155 on all platforms. Users running the affected stable channel are potentially vulnerable until they install the patched release.

The CVSS score is not supplied, but the EPSS indicator of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Nevertheless, because the attack requires a compromised renderer process—achievable through an untrusted extension or malicious web content—the threat is real for environments that allow arbitrary extensions or user‑generated content. The only official remediation is to update to the fixed Chrome version.