This vulnerability in Google Chrome's SiteIsolation feature allows a remote attacker with control over the renderer process to bypass site isolation protections via a crafted HTML page. The issue is due to an inappropriate implementation of SiteIsolation prior to version 151.0.7922.72. The CVSS score is 4.2 (medium severity), indicating low confidentiality and integrity impacts with no availability impact. The vulnerability is identified as CWE-693 (Protection Mechanism Failure). There is no explicit vendor advisory statement confirming a patch or fix, and no known exploits in the wild have been reported.

An attacker who has already compromised the renderer process can bypass site isolation protections, potentially accessing data or processes that should be isolated. The impact is limited to confidentiality and integrity with no availability impact. No active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html for current remediation guidance. Until confirmation of a fix, users should exercise caution with untrusted content that could compromise the renderer process.