This vulnerability arises from an inappropriate implementation of Site Isolation in Google Chrome versions before 149.0.7827.53. Site Isolation is a security feature designed to separate different websites into different processes to prevent data leakage across sites. The flaw allows an attacker with control over the renderer process to bypass these isolation boundaries using a crafted HTML page, potentially exposing sensitive information from other sites. The CVSS score is 5.3 (medium), reflecting network attack vector, high attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality only. The vendor advisory linked does not explicitly state if a fix is available or if users should take specific actions.

An attacker who has already compromised the renderer process can bypass site isolation protections, potentially leading to unauthorized access to sensitive data from other sites within the browser. This impacts confidentiality but does not affect integrity or availability. No known exploits in the wild have been reported to date.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for current remediation guidance. Until an official fix is confirmed, users should exercise caution with untrusted content and consider updating to the latest Chrome version once available.