The vulnerability is caused by insufficient validation of untrusted input in Chrome’s Input module, enabling an attacker who has already compromised the renderer process to serve a crafted HTML page that bypasses site isolation. This undermines the browser’s protection against cross‑site data leakage, allowing the attacker to access information from another site’s renderer and potentially exfiltrate sensitive data. The weakness is classified as CWE‑20 and CWE‑1289.

Google Chrome versions older than 148.0.7778.216 are affected.

The issue carries a high severity designation with a CVSS score of 7.9. Exploitation requires that the attacker first achieve a foothold within Chrome’s renderer process—typically through a separate vulnerability—after which the crafted page can be delivered to force Chrome to disregard site isolation boundaries. The EPSS score indicates a very low exploitation probability (<1%) and the vulnerability is not listed in CISA’s KEV catalog. Nevertheless, a successful bypass would lead to serious data disclosure and undermines the fundamental isolation guarantees of the browser.