This vulnerability in Google Chrome's WebUI on multiple platforms allows an attacker with control over the renderer process to bypass site isolation protections through crafted HTML content. Site isolation is a security feature designed to separate different websites into different processes to prevent data leakage or unauthorized access. The flaw is due to insufficient enforcement of policies within the WebUI component. The affected versions are all Chrome versions prior to 148.0.7778.96. No CVSS score or detailed remediation information is provided in the input data, and no known exploits are reported in the wild.

If exploited, this vulnerability could allow an attacker who has already compromised the renderer process to bypass site isolation, potentially enabling access to data or processes that should be isolated. This could weaken the browser's security boundary between sites, increasing risk of data leakage or unauthorized access within the browser context. However, exploitation requires prior compromise of the renderer process, limiting the initial attack surface.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html for current remediation guidance. Since the vulnerability affects versions prior to 148.0.7778.96, updating to version 148.0.7778.96 or later is recommended once confirmed by the vendor. No other specific mitigations are provided in the advisory.