An implementation flaw in Chrome’s extension handling allows a compromised renderer process to serve a crafted HTML page that bypasses the browser’s site isolation boundary. This flaw enables an attacker who has already gained control over the renderer to cause isolation units that are normally separated by origin to be merged, potentially allowing interaction between otherwise isolated web origins.

All builds of Google Chrome older than version 151.0.7922.72 on any supported operating system are affected. Users running these earlier versions are vulnerable if their renderer process is compromised, regardless of the extensions installed.

The CVSS score of 6.5 indicates a medium severity vulnerability, and the EPSS score of less than 1% suggests that active exploitation is unlikely at present. The flaw is not listed in CISA’s KEV catalog, indicating no widespread exploitation is known. The likely attack path involves first compromising the renderer process through code execution or other means, then delivering a forged HTML page that triggers the site isolation bypass.