The flaw is an insufficient validation of untrusted input stored in Chrome's Persistent Cache, which permits a remote attacker who has already compromised a renderer process to craft a malicious HTML page that bypasses site isolation. Inferred from the vulnerability description, site isolation normally prevents code or data from one origin from accessing resources of another, so this bypass could allow the attacker to read or inject content across site boundaries. The weakness is categorized as CWE‑20 and CWE‑1286, indicating improper input validation and mode impairment.

Chrome installations older than version 148.0.7778.96 on Windows, macOS, and Linux are affected, as the issue exists in all stable channel releases prior to that version. All operating systems supported by Chrome via the listed CPEs are potentially impacted, as the vulnerability is tied to the browser's internal caching mechanism rather than OS-specific features.

The documented CVSS score is 3.1, reflecting low overall severity, and the EPSS score of less than 1% indicates an extremely low likelihood of exploitation at this time. The vulnerability is not included in the CISA KEV catalog. Since exploitation requires a prior compromise of the renderer process, the threat is indirect and limited to environments where such a compromise could realistically occur; no known public exploits have been disclosed.