EUVD-2026-34701
GHSA-6mv5-742f-xf8v
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
Primary rating from Vendor (google) · only source for this CVE.
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Insufficient validation of untrusted input in Loader in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Low)
AnalysisAI
Site isolation bypass in Google Chrome's Loader component (versions prior to 149.0.7827.53) allows a remote attacker who has already compromised the renderer process to escape Chrome's cross-site data boundary via a crafted HTML page. The vulnerability stems from insufficient validation of untrusted input in the Loader, enabling a post-exploitation primitive that leaks limited confidentiality data across site boundaries. With a CVSS score of 3.1 (Low), EPSS at 0.02% (6th percentile), no CISA KEV listing, and Chromium's own classification as Low severity, this represents a low-urgency chained-exploit stepping stone rather than a standalone critical threat; no public exploit identified at time of analysis.
Technical ContextAI
Chrome's Loader component is responsible for fetching and processing web resources - URLs, HTTP responses, and associated metadata - on behalf of renderer processes. Chrome's site isolation architecture enforces that each site's renderer runs in a separate process and cannot directly access another site's data; the Loader acts as a gatekeeper in this boundary enforcement. CWE-20 (Improper Input Validation) identifies the root cause: the Loader does not adequately validate input received from a (potentially hostile) renderer, allowing crafted data to subvert the site isolation checks. Affected versions are all Google Chrome desktop releases prior to 149.0.7827.53, as confirmed by the ENISA EUVD entry EUVD-2026-34701 and the Chromium issue tracker reference at issues.chromium.org/issues/497030032.
RemediationAI
The primary fix is to update Google Chrome to version 149.0.7827.53 or later, as released in the June 2026 stable channel update documented at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Chrome's auto-update mechanism will apply this for most users automatically; administrators managing enterprise deployments should verify rollout via Google Admin Console or push the update through endpoint management tooling. No specific workaround is documented in the available references. Given the prerequisite of renderer compromise, organizations with strict security requirements may additionally consider enabling strict site isolation policies via enterprise policy (already default in modern Chrome, but verifiable via chrome://policy) and monitoring for renderer crash anomalies indicative of exploit attempts, though these measures address the prerequisite rather than this specific flaw.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today