This vulnerability arises from insufficient validation of untrusted input within the ReadingMode component of Google Chrome on Mac versions before 148.0.7778.168. An attacker with control over the renderer process could exploit this to bypass site isolation, a security feature designed to separate web content into different processes to prevent cross-site attacks. The issue is recognized as high severity by Chromium security but lacks a CVSS score and explicit remediation details in the provided advisory.

If exploited, this vulnerability could allow an attacker who has compromised the renderer process to bypass site isolation, potentially enabling cross-site data access or other unauthorized interactions within the browser environment. However, exploitation requires prior compromise of the renderer process, limiting the initial attack vector. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html for current remediation guidance. Users should update Google Chrome on Mac to version 148.0.7778.168 or later once confirmed. Until then, no specific mitigation steps are provided by the vendor.