Google Chrome versions prior to 153.0.8010.36 contain a missing authorization flaw in the Core component (CWE-862) that allows an attacker who has already compromised a renderer process to bypass the browser’s site‑isolation boundaries by serving a specially crafted HTML page. The vulnerability does not provide remote code execution directly; its primary impact is elevating privileges within the browser context, potentially exposing data or influencing other web content from a compromised site.

The flaw affects all Google Chrome releases before 153.0.8010.36 across all operating systems. Exact sub‑versions are not enumerated, but the safety margin ends at that patch number, so any build older than 153.0.8010.36 is considered vulnerable until the update is applied.

Chromium has classified the issue with low internal severity, reflected by a CVSS score of 4.3, and no public exploit is known. The EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires that an attacker already gains control of a renderer process, a condition that is hard to achieve in practice without additional foothold or privilege. Nevertheless, once the renderer is compromised, the missing authorization allows the attacker to escape site isolation, potentially leading to data exposure or further compromise of the host. The risk remains moderate in environments where renderer compromise is plausible, but it is not considered an immediate, broad‑scale threat.