This vulnerability arises from insufficient validation of untrusted input in the compositing functionality of Google Chrome versions before 147.0.7727.138. An attacker with control over the renderer process could exploit this to bypass site isolation protections via a crafted HTML page. Site isolation is a security feature designed to separate web content from different origins into different processes to prevent data leaks. The CVSS score of 3.1 reflects a low-severity impact with network attack vector, high attack complexity, no privileges required, user interaction required, unchanged scope, and low confidentiality impact. No official remediation level or patch link is provided in the data, but a vendor advisory URL is available.

The impact is limited to a low confidentiality breach potential by bypassing site isolation if the attacker has already compromised the renderer process. There is no impact on integrity or availability. The vulnerability requires user interaction and has high attack complexity, reducing the likelihood of exploitation. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop_28.html for current remediation guidance. Since the vulnerability affects Chrome versions prior to 147.0.7727.138, updating to this version or later is recommended if the vendor advisory confirms a fix. No other specific mitigations are indicated in the provided data.