The flaw lies in an inappropriate implementation of Cross‑Origin Resource Sharing (CORS) that allows an attacker who has already compromised the renderer process to bypass Chrome’s site isolation feature. This bypass can lead to the attacker making the renderer access resources from other sites that are normally restricted, potentially exposing sensitive data or enabling further attacks.

Google Chrome versions older than 151.0.7922.169 are affected. The vulnerability exists in the stable channel of Chrome for desktop users relying on the default site isolation configuration.

The vulnerability is considered high severity by Chromium security. Exploitation requires the attacker to have already compromised the renderer process, which may be achieved through a prior vulnerability or social engineering. The CVSS score of 4.2 indicates medium severity and the EPSS score of less than 1% suggests a very low exploitation probability. The issue is not listed in CISA’s KEV catalog. Because the attack vector depends on first compromising the renderer, the risk is limited to environments where such compromise is possible. Nonetheless, the potential to break site isolation warrants prompt remediation.