The vulnerability arises from insufficient validation of untrusted input in the compositing component of Chrome. An attacker who has compromised a renderer process can supply a specially crafted HTML page that bypasses Chrome’s site isolation, allowing that process to access resources belonging to other sites. This effectively lifts the isolation boundary and can lead to data theft, credential compromise, or other attacks against users while Chrome is running. The flaw is classified as CWE‑20 and is rated high severity by Chromium.

Affected versions are all releases of Google Chrome before 147.0.7727.138. The problem does not exist in later releases where the patch has been applied.

Because the exploit requires an attacker to first compromise the renderer process, the risk is lower than a purely remote exploit, and the EPSS score is unavailable. The CVSS score is not listed here, but the vulnerability is marked high severity and is not in CISA’s KEV catalog. In practice, the attack vector is a crafted HTML page delivered to a user who has already compromised a renderer, possibly via drive‑by or malicious add‑ons, making the threat more limited but still significant for affected Chrome users.