This vulnerability (CVE-2026-7959) affects Google Chrome versions before 148.0.7778.96. It stems from an inappropriate implementation in the Navigation feature that enables a remote attacker, with prior control over the renderer process, to bypass site isolation protections via a crafted HTML page. The issue is classified under CWE-693 (Protection Mechanism Failure) and CWE-284 (Improper Access Control). The CVSS v3.1 score is 3.1, indicating low severity, with network attack vector, high attack complexity, no privileges required, and user interaction needed. The vendor advisory does not explicitly confirm patch availability or remediation steps.

The impact is limited to a low-severity bypass of site isolation protections in Chrome when the attacker has already compromised the renderer process. This could potentially allow the attacker to access data or content from other sites that should be isolated. There is no indication of direct code execution, denial of service, or data integrity impact. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html for current remediation guidance. Until an official fix is confirmed, users should ensure they do not run untrusted content in Chrome and maintain updated browser versions. No additional vendor-provided mitigations are specified.