Insufficient policy enforcement in the navigation handling component of Google Chrome allowed a malicious actor to craft an HTML page that, when loaded, bypasses the browser’s site isolation protection. Based on the description, it is inferred that the failure undermines the isolation boundaries that normally keep separate web origins from interacting, potentially enabling a user to access sensitive information or execute operations in a context that should be segregated. The underlying weakness reflects a lack of proper policy validation and enforcement, and, based on the description, it is inferred that this can lead to confidentiality and integrity exposures in the browser environment.

All installations of Google Chrome prior to version 150.0.7871.115 are affected. No additional vendor or product variants are listed.

The vulnerability has a CVSS score of 4.3. It can be exploited remotely via a specially crafted HTML page served over the network. The attack does not require elevated privileges or local access; it relies solely on the victim's browser rendering a malicious page. EPSS score is less than 1%, indicating a very low exploitation probability, and the CVE is not listed in the CISA KEV catalog, indicating no publicly known exploit at the time of analysis. Based on the description, it is inferred that the potential impact remains significant due to the fundamental nature of site isolation in protecting multiple web contents from one another.