A missing authorization check in Google Chrome extensions enabled a remote attacker who had already compromised the renderer process to bypass site isolation by serving a crafted HTML page. This flaw corresponds to CWE-653 and CWE-862. The vulnerability allows the attacker to access data or perform actions across isolated sites, effectively escalating privileges over sandbox boundaries.

Google Chrome versions prior to 154.0.8037.57 are affected. All users running these versions of Chrome’s stable channel may be vulnerable and should upgrade.

The CVSS score of 8.1 indicates a high severity. The EPSS score is not disclosed, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker who can inject a crafted page into a compromised renderer process, a scenario that is feasible in environments where extensions or other sandboxed components are misused. Due to the lack of publicly available exploit evidence, the likelihood of widespread attacks remains uncertain, yet the potential impact warrants proactive mitigation.