An improper control of a worker resource during its lifetime allows a remote attacker, once the renderer process is compromised, to bypass the browser’s site isolation boundary. The weakness, categorized as CWE-664, can lead to cross-origin information leakage and potential elevation of privilege within the browser context, but does not enable arbitrary code execution. The impact is confined to the compromised renderer and does not provide direct remote code execution on the host system.

The vulnerability affects Google Chrome versions earlier than 152.0.7977.65. The issue is specific to the Workers implementation in the Chrome browser and does not apply to other Chromium-based products unless they share the same vulnerable component and version. Users should verify the exact build number of their Chrome installation.

The EPSS score is < 1% and the vulnerability is not listed in the CISA KEV catalog, indicating a low likelihood of widespread exploitation. The CVSS score is 3.1, a low severity rating. The Chromium security severity is also low, and the risk primarily exists when the renderer process is already compromised; the flaw allows a site isolation bypass in such scenarios. Patching to 152.0.7977.65 or later mitigates the issue and should be treated as a priority update.