This vulnerability stems from insufficient validation of untrusted input within the Site Isolation feature of Google Chrome prior to version 148.0.7778.216. It enables an attacker who has already compromised the renderer process to bypass the isolation boundary by serving a specially crafted MHTML page. The result is that a malicious renderer can access resources from other sites, compromising data confidentiality and integrity. The weakness is classified as CWE‑20 (Input Validation) and CWE‑1173.

Google Chrome browsers running any version earlier than 148.0.7778.216 are affected. The vulnerability applies to all platforms that use this Chrome release, as the issue lies in the generic site isolation implementation rather than a platform‑specific component.

The CVSS score is 5, indicating medium severity, and the EPSS score of <1% indicates a very low probability of exploitation, while the lack of a KEV listing indicates no known mass exploitation at the time of this analysis. The likely attack vector is an attacker who can execute code in a renderer process and deliver a crafted MHTML page, which is then processed by the vulnerable site isolation code. Given the medium impact and potential for widespread exploitation if an attacker can target many users, the risk remains significant.