An inappropriate implementation in Chrome’s Site Isolation feature was found in versions prior to 151.0.7922.72. A malicious web page can be crafted to trick the browser into treating it as if it were part of another origin, thereby allowing the attacker to read from or write to data that should be isolated, such as cookies, local storage, or other memory associated with a trusted site. This can lead to credential theft, data leakage, or the compromise of other security controls that rely on site isolation.

The vulnerability affects all installations of Google Chrome on supported operating systems that are running any build before 151.0.7922.72. No specific patch levels were enumerated beyond the removal of the flaw in the newer release, so any older Chrome releases remain exposed.

The CVSS score of 5.4 indicates a medium‑severity flaw, while the EPSS score of less than 1 % suggests a very low but nonzero exploitation probability. The flaw is not yet listed in the CISA KEV catalog. The likely attack vector involves an attacker hosting a malicious page on the web; when a user visits that page, the crafted content activates the Site Isolation bypass and crosses origin boundaries.