The vulnerability in Google Chrome arises from insufficient enforcement of extension policies in versions prior to 150.0.7871.47. If a remote attacker has already compromised the renderer process, they can serve a specially crafted HTML page that tricks the browser into bypassing the normal site isolation protections. This compromise permits the attacker to mix data from separate web origins, potentially accessing or manipulating content that should be isolated. The weakness indicates an information disclosure due to improper access control.

All users running Google Chrome versions earlier than 150.0.7871.47 are impacted by the extension policy enforcement issue. The vulnerability was documented in Chrome's stable channel release notes and the Chromium issue tracker, and the fix is included in the update for that version.

The vulnerability is scored with a CVSS base of 6.5, reflecting moderate severity. The EPSS score of less than 1% indicates a low but nonzero likelihood that the flaw will be exploited. The issue is not currently listed in the CISA KEV catalog. Exploitation requires an attacker to gain control of the renderer process, a condition that is not trivial. Based on the description, it is inferred that a malicious or compromised extension is a common method to reach that state, but the exact attack vector is not detailed in the CVE record.