Insufficient policy enforcement in File System Access within Google Chrome before version 149.0.7827.155 allows a remote attacker who has compromised the renderer process to bypass site isolation through a specially crafted PDF file. The primary impact is the potential exposure of data from isolated web content, enabling cross‑site data leakage and potentially further exploitation.

All stable channel releases of Google Chrome older than 149.0.7827.155 are affected, impacting users who encounter PDFs from untrusted sources.

The EPSS score indicates a very low probability of exploitation and the vulnerability is not listed in CISA’s KEV catalog. However, the Chromium severity rating is high and exploitation requires the attacker to first compromise the renderer process, likely through another local exploit, before delivering a crafted PDF to trigger the policy violation. Given the high impact that a site isolation bypass could cause, the overall risk remains significant until the patch is applied.