This vulnerability in Google Chrome's Site Isolation feature arises from insufficient validation of untrusted input, enabling an attacker with control over the renderer process to bypass site isolation via a crafted MHTML page. Site Isolation is a security mechanism designed to separate different websites into distinct processes to prevent data leakage or cross-site attacks. The affected version is prior to 148.0.7778.216. The vendor advisory linked does not explicitly state patch availability or remediation details, and no CVSS score is assigned.

If exploited, this vulnerability could allow an attacker who has compromised the renderer process to bypass site isolation protections, potentially leading to unauthorized access to data from other sites or processes that should be isolated. This undermines a key security boundary in Chrome, increasing the risk of cross-site data leakage or privilege escalation within the browser context. However, exploitation requires prior compromise of the renderer process, limiting the initial attack vector.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html for current remediation guidance. Until official fixes are confirmed, users should exercise caution with untrusted MHTML content and consider disabling MHTML support if feasible. Monitor official Google Chrome release notes for updates addressing this vulnerability.