The vulnerability exists because Chrome does not sufficiently validate untrusted input stored in the Persistent Cache. When a renderer process has been compromised, an attacker can craft a malicious HTML page that bypasses the browser’s site isolation protection. Site isolation normally prevents code from one site from reading or influencing data from another site, so this flaw can lead to cross‑site data leakage or further escalation within the browser. The weakness is classified as CWE‑20, Input Validation.

Users of Google Chrome on desktop whose installations are older than version 148.0.7778.96 are affected. The issue applies to all stable channel releases on Windows, macOS, and Linux until the next update. Versions equal to or newer than 148.0.7778.96 do not contain the flaw.

The Chromium team rated the vulnerability as Medium with a CVSS score of 3.1. No EPSS score is available, suggesting that exploitation is possible but not necessarily common. The flaw requires the attacker to have already compromised a renderer process, a prerequisite that limits immediate risk. Because site isolation is a core browser boundary, a successful exploit could expose sensitive data from other sites. The vulnerability is not listed in the CISA KEV catalog and currently there is no publicly available exploit.