Google Chrome’s Site Isolation feature fails to validate untrusted input, allowing a renderer process that has been compromised by an attacker to serve a specially crafted HTML page that bypasses isolation. The defect is classified as high severity by Chromium.

The vulnerability exists in all Google Chrome installations prior to version 148.0.7778.168. Users running any older release are affected; newer releases include the patch.

The EPSS score is < 1% and the vulnerability is not listed in CISA’s KEV catalog. The CVSS score of 4.3 indicates medium severity. Based on disclosed severity, an attacker who can already compromise a renderer process can exploit this flaw. While evidence of a public exploit is lacking, the combination of high impact and the requirement for initial renderer compromise suggests a moderate to high risk for environments where such compromises are probable. The attack vector is inferred as a compromised renderer process delivering malicious HTML, as the description indicates that a remote attacker uses renderer access to bypass Site Isolation.