AIKIDO-2024-10485

TL;DR

An inappropriate implementation in Google Chrome Extensions, in versions prior to 131.0.6778.69, allows a remote attacker to bypass site isolation by leveraging a crafted Chrome extension. Site isolation is a security feature designed to separate web content from different domains into separate processes, limiting the impact of vulnerabilities and preventing cross-origin data leaks. By exploiting this flaw, an attacker can bypass these protections, potentially accessing or manipulating data from different origins. This vulnerability poses a significant risk as it undermines Chrome's built-in defenses against attacks like cross-site scripting (XSS) and cross-origin data theft. The issue has been classified with a MEDIUM severity rating by the Chromium security team.