Inappropriate handling of password data in Google Chrome allowed a remote attacker who had already compromised the renderer process to bypass site isolation using a crafted HTML page. The flaw enables the attacker to break out of the renderer sandbox, access privileged browser processes, and potentially read or manipulate user credentials and other sensitive data that would normally be protected by site isolation. The vulnerability is classified as high severity by Chromium security.

Google Chrome browsers prior to version 149.0.7827.197 are affected. Any deployment running an earlier stable version of the Chrome browser is vulnerable until updated to the specified release or later.

The CVSS score is not provided in the public data, but the vulnerability is listed as high severity. EPSS is not available, and the issue is not currently listed in CISA KEV. The likely attack vector is a malicious or compromised webpage accessed by an unsuspecting user; the attacker must first achieve code execution in the renderer process, after which the site isolation bypass can be triggered. Given the lack of publicly disclosed exploit tools and the requirement for a compromised renderer, the exploitation likelihood is moderate to high for active attackers with advanced capabilities. The potential impact includes unauthorized access to stored passwords, session data, and other sensitive information that could lead to credential theft, account takeover, or broader system compromise.