The vulnerability arises from an uninitialized use in the ANGLE graphics stack within Chrome. A remote attacker who has already compromised the renderer process can trigger the flaw through a crafted HTML page, causing Chrome to bypass its site isolation boundaries. This allows data or actions that should be isolated to other web pages or processes to be accessed or manipulated, compromising confidentiality and integrity of separate browsing contexts.

Google Chrome browsers prior to version 148.0.7778.216 are affected. The issue is specifically present in the ANGLE component of Chrome and does not extend to other Google products listed by the CNA.

The CVE has a CVSS score of 5, indicating medium severity, and the attacker must first gain control of the renderer process, which typically requires a separate exploit or a privileged state. The EPSS score is < 1%, and the lack of a KEV listing suggests no widespread exploitation has been observed yet. Nonetheless, given the high impact of site isolation bypass, the risk remains significant for systems that have not applied the fix and when the renderer process can be compromised by malicious content.