The CVE describes an insufficient validation of untrusted input in Chrome’s SiteIsolation implementation. A crafted HTML page can cause a renderer process that has already been compromised to skip isolation checks, allowing the attacker to read or alter data from other sites and potentially elevate privileges within the browser. This is an input validation weakness (CWE‑20).

All Google Chrome releases older than 148.0.7778.96 are vulnerable. The flaw was addressed in the 148.0.7778.96 patch referenced in the Chrome release notes.

The CVSS score of 6.3 indicates moderate severity, but the EPSS score is not available, so the exact likelihood of exploitation cannot be determined. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires a remote attacker who has achieved control over a renderer process and the delivery of a crafted HTML page, so it involves multiple prerequisites but is feasible with existing capabilities.