EUVD-2026-37542Severity by source
Sources disagree (Medium–Critical)AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
S:C assigned over S:U because site isolation bypass inherently crosses origin boundaries, accessing data outside the exploited context; all other metrics align with provided vector.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorCISA-ADP
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
Lifecycle Timeline
3DescriptionCVE.org
Inappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Extensions subsystem in Google Chrome before 149.0.7827.155 contains a protection mechanism failure (CWE-693) that enables a post-compromise attacker to break Chrome's site isolation boundary using a crafted HTML page. This is a second-stage chained vulnerability - not an initial access vector - as exploitation explicitly requires the attacker to have already gained control of the renderer process through a separate flaw. No public exploit has been identified at time of analysis, and EPSS places exploitation probability at 0.23% (14th percentile), consistent with the SSVC assessment of no observed exploitation and non-automatable attack chain.
Technical ContextAI
Chrome's site isolation architecture confines each website's content to a dedicated renderer process, preventing cross-origin data access even if one page is malicious. CWE-693 (Protection Mechanism Failure) indicates the Extensions subsystem fails to correctly enforce this isolation under specific conditions, allowing the isolation boundary to be crossed when the renderer is already under attacker control. The affected product is identified by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* for all Chrome versions prior to 149.0.7827.155 on desktop platforms. Tags indicate downstream relevance to Red Hat and SUSE Linux distributions that package Chrome or Chromium.
RemediationAI
Upgrade Google Chrome to version 149.0.7827.155 or later; this is the vendor-released patch confirmed via the Chrome Stable Channel advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_01750511403.html. Chrome's auto-update mechanism will apply this silently on most consumer systems; enterprise administrators should verify fleet compliance using Chrome Browser Cloud Management or equivalent MDM tooling. Because exploitation requires a pre-compromised renderer process, organizations already enforcing Chrome's process sandbox, running endpoint detection capable of identifying renderer exploitation, and restricting extension permissions via enterprise policy have meaningful compensating controls - though none fully substitute for the patch. Linux administrators on Red Hat or SUSE should monitor their distribution's Chromium package advisory channels for downstream patched builds.
Same weakness CWE-693 – Protection Mechanism Failure
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today