An inappropriate network implementation in Google Chrome on Android versions prior to 150.0.7871.47 permits a remote attacker who has already compromised the renderer process to load a specially crafted HTML page that bypasses the browser’s site isolation. This flaw forces the browser to treat multiple site origins as if they to another. The weakness is categorized as CWE-346 (Broken Access Control).

The vulnerability affects all Android devices running Google Chrome versions earlier than 150.0.7871.47, regardless of device model or Android version.

Chromium rates this vulnerability as medium severity, with a CVSS score of 6.5. Based on the description, the attack vector involves a remote attacker who has already compromised the renderer process; the EPSS score is less than 1%, indicating a low probability of exploitation in the wild, and it is not listed in the CISA KEV catalog. Successful exploitation requires the attacker to first gain control of the renderer process—typically through a separate local compromise or another vulnerability, after which a crafted HTML payload can be rendered to break site isolation.