This vulnerability in Google Chrome arises from insufficient policy enforcement in the WebUI across multiple platforms before version 148.0.7778.96. An attacker with control over the renderer process can bypass site isolation protections by leveraging a crafted HTML page. Site isolation is a security feature designed to separate different sites into different processes to mitigate cross-site attacks. The CVSS score is 4.3 (medium), reflecting a network attack vector with low impact on confidentiality and no impact on integrity or availability. The vulnerability is tracked as CWE-693 (Protection Mechanism Failure).

A remote attacker who has already compromised the renderer process can bypass site isolation, potentially increasing the risk of cross-site data leakage or other attacks that site isolation aims to prevent. However, the impact is limited to confidentiality with no direct integrity or availability consequences. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html for current remediation guidance. Until an official fix is confirmed, users should exercise caution with untrusted content and consider updating to the latest Chrome version once available. No additional vendor-provided mitigations are specified.