EUVD-2026-39039
GHSA-32q7-rqp9-688w
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L
Site isolation bypass implies scope change (S:C); renderer-already-compromised prerequisite justifies AC:H; confidentiality of cross-origin data is high; no integrity or availability impact from navigation bypass alone.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Insufficient validation of untrusted input in Navigation in Google Chrome prior to 149.0.7827.197 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Site isolation bypass in Google Chrome's Navigation component allows an attacker who has already compromised the renderer process to escape Chrome's cross-origin containment boundary via a crafted HTML page, affecting all Chrome versions prior to 149.0.7827.197. The vulnerability stems from insufficient input validation (CWE-20) in the Navigation subsystem, which fails to properly enforce site isolation when navigations are initiated from a compromised renderer. No public exploit code has been identified and CISA SSVC confirms no known active exploitation at time of analysis, though the prerequisite of renderer compromise makes this a meaningful second-stage escalation primitive.
Technical ContextAI
Google Chrome enforces site isolation as a defense-in-depth mechanism that confines each renderer process to resources belonging to a single site, preventing cross-origin data leakage even if the renderer is compromised. This vulnerability (CWE-20: Improper Input Validation) exists in the Navigation component, which handles cross-document navigations initiated by renderer processes. When a renderer has been compromised, it can submit crafted navigation inputs that fail validation checks, allowing the attacker to subvert the site isolation boundary and potentially access data belonging to other origins. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* for all versions prior to 149.0.7827.197. This class of vulnerability is often called a sandbox escape enabler or isolation bypass and typically serves as the second stage in a two-bug exploit chain against browser targets.
RemediationAI
Update Google Chrome to stable channel version 149.0.7827.197 or later, as documented in the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0482630350.html. Chrome typically auto-updates, but administrators managing enterprise deployments should verify forced update policies are active and confirm the installed version via chrome://settings/help. As a compensating control prior to patching, enabling Chrome's 'Strict Site Isolation' policy (SitePerProcess=enabled) at the enterprise policy level may reduce the blast radius, though this setting is already default in modern Chrome; review any enterprise policies that may have disabled it. Blocking untrusted or external HTML content at the network perimeter will reduce exposure to the initial renderer exploit that must precede this vulnerability. Note that no workaround fully eliminates the risk of this bypass if the renderer is already compromised - patching is the only definitive remediation.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Authentication Bypass
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today