EUVD-2026-35258
GHSA-q4p8-cgh7-q73x
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Lifecycle Timeline
4DescriptionNVD
Insufficient validation of untrusted input in Extensions in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Site isolation bypass in Google Chrome's Extensions subsystem prior to 149.0.7827.103 enables a remote attacker who has already compromised the renderer process to defeat cross-origin security boundaries via a crafted HTML page requiring one user interaction. The root cause is CWE-20 (Improper Input Validation) in the Extensions layer, meaning the Extensions subsystem fails to adequately validate untrusted input before acting on it across site isolation boundaries. EPSS is low at 0.02% (6th percentile), no public exploit code or CISA KEV listing exists at time of analysis, and a vendor patch is confirmed at 149.0.7827.103.
Technical ContextAI
Google Chrome's site isolation architecture partitions renderer processes by origin to prevent cross-site data leakage - a core Chromium defense against Spectre-class and cross-origin attacks. The affected component is the Extensions subsystem, which interfaces with renderer processes and processes HTML content. CWE-20 (Improper Input Validation) describes the root cause: the Extensions layer does not sufficiently validate untrusted input received from a compromised renderer before allowing cross-origin actions, permitting a renderer-level attacker to breach site isolation. The CVSS vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N indicates the attacker can reach the vulnerable code from the network, with no privileges at the browser level (though renderer compromise is a significant implicit prerequisite), requiring one user interaction to trigger the crafted HTML page. The integrity impact is rated High while confidentiality is unaffected, consistent with a site isolation bypass that tampers with cross-origin page content rather than exfiltrating data.
RemediationAI
Update Google Chrome to version 149.0.7827.103 or later, which is the confirmed vendor-released patch per the stable channel update advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html. Users should verify their Chrome version via Settings > About Chrome and allow the automatic update to complete. In enterprise environments, push the update via group policy or your endpoint management platform immediately, prioritizing any systems where Chrome extensions are heavily used or where users may visit untrusted sites. If patching is temporarily delayed, restricting or disabling browser extensions via enterprise policy reduces the attack surface within the affected Extensions subsystem, though this may disrupt productivity workflows. Because this vulnerability requires renderer compromise as a prerequisite, maintaining up-to-date patches for all Chromium renderer vulnerabilities significantly reduces the overall exploit chain viability. No workaround fully mitigates the issue without patching; disabling JavaScript would prevent renderer-level exploitation but is operationally infeasible in most environments.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today