This vulnerability arises from insufficient data validation and policy enforcement in the GuestView feature of Google Chrome before version 150.0.7871.47. An attacker who has already compromised the renderer process can exploit this flaw to bypass site isolation protections by delivering a crafted HTML page. Site isolation is a security mechanism designed to separate different websites into different processes to prevent data leaks or unauthorized access. The CVSS 3.1 base score is 6.5, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact. The vulnerability is tracked as CWE-602 (Insufficient Control of Generation of Code).

The vulnerability allows an attacker with control over the renderer process to bypass site isolation, potentially enabling unauthorized interactions or manipulations across site boundaries. This impacts the integrity of the browser's security model but does not affect confidentiality or availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html for current remediation guidance. Since the affected version is prior to 150.0.7871.47, updating to version 150.0.7871.47 or later is recommended once confirmed by the vendor. No other specific mitigations are provided.