The vulnerability is an access control weakness in Google Chrome’s navigation handling before version 148.0.7778.96. A remote attacker who has already compromised a renderer process can craft a malicious HTML page that triggers the flaw and bypasses Chrome’s site isolation boundaries. The flaw is rooted in a lack of proper Access Control (CWE‑284), Broken Access Control (CWE‑653), and Security Misconfiguration (CWE‑693) in navigation handling. Based on the description, it is inferred that bypassing site isolation may allow the attacker to access content from other sites.

Google Chrome desktop releases with versions earlier than 148.0.7778.96 are affected. The issue is specific to the renderer process and applies to Windows, macOS, and Linux desktop environments.

The CVSS score is 3.1, indicating a low overall severity. Exploitation requires a preceding compromise of the renderer process, which limits the attack surface to systems where malicious code has already been introduced via an exploit or a rogue extension. The EPSS score of 0.00023 (less than 1%) and the absence from CISA’s KEV catalog suggest that the vulnerability is not currently widely exploited. Nevertheless, once the renderer is compromised, the flaw could lead to a breach of confidentiality or integrity for data from other origins.