The vulnerability is a use‑after‑free flaw in the Views layer of Google Chrome. It allows an attacker who has already compromised the renderer process to execute code that bypasses Chrome’s site isolation safeguards. This capability can be abused to access data from other sites or to tamper with cross‑origin page content, effectively breaking the isolation that protects distinct web origins. The weakness is classified as CWE‑416.

The flaw exists in Google Chrome versions prior to 148.0.7778.96. Users running those builds are affected regardless of operating system or architecture. The vulnerability can be triggered by loading a specially crafted HTML page into a compromised renderer instance.

The CVE is rated as High by Chromium’s own severity analysis. No EPSS score is available, and it is not listed in the CISA KEV catalog, suggesting it may not be widely exploited yet. However, the attack requires that the renderer process have already been compromised, which could occur through zero‑day exploitation of another Chrome weakness or via malicious extensions with high privileges. If that foothold is achieved, the crafted HTML can be delivered remotely and the isolation bypass performed with low additional cost.