The vulnerability arises from insufficient validation of untrusted input in the compositing component of Google Chrome. An attacker who has already compromised a renderer process can supply a specially crafted HTML page that bypasses Chrome’s site isolation, lifting the isolation boundary and permitting that process to access resources belonging to other sites. This can lead to data theft, credential compromise, or other attacks against users while Chrome is running. The flaw is classified as CWE-1173 and CWE-20, and is rated low severity with a CVSS score of 3.1 by Chromium. The likely attack vector is delivering a crafted HTML page to a Chrome instance that hosts a compromised renderer, such as via a malicious extension or drive‑by activity.

Affected versions are all releases of Google Chrome before 147.0.7727.138. The problem does not exist in later releases where the patch has been applied.

Because the exploit requires an attacker first to compromise the renderer process, the risk is lower than a purely remote exploit. Based on the description, it is inferred that the attacker would likely succeed by delivering a crafted HTML page to a compromised renderer, possibly via a malicious extension or drive‑by download. The EPSS score of <1% indicates a very low but nonzero exploitation probability, and the CVSS score of 3.1 reflects low severity. The vulnerability is not listed in the CISA KEV catalog. Despite the limited attack surface, users running affected Chrome versions without the fix remain at risk.