This vulnerability arises from improper data validation in the Navigation implementation of Google Chrome versions before 150.0.7871.115. It enables a remote attacker to bypass site isolation protections by delivering a specially crafted HTML page. The CVSS 3.1 base score is 4.3 (medium), reflecting a network attack vector with low complexity, no privileges required, user interaction needed, unchanged scope, and limited confidentiality impact. The vulnerability is tracked as CWE-20 (Improper Input Validation).

An attacker can bypass site isolation mechanisms in affected Chrome versions, potentially allowing access to data from other sites within the browser process. The impact is limited to confidentiality loss without affecting integrity or availability. No known active exploitation has been reported.

The vendor advisory linked does not explicitly confirm a patch or remediation status. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should update to Chrome version 150.0.7871.115 or later once confirmed patched. Until then, exercise caution with untrusted HTML content and consider applying any official updates from Google promptly.