EUVD-2026-40557
GHSA-mrqm-jvh8-pw4f
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
AC:H reflects the hard prerequisite of a pre-compromised renderer; S:C captures the site isolation boundary crossing inherent in a GuestView policy bypass reaching cross-origin contexts.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Insufficient policy enforcement in GuestView in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
GuestView policy enforcement in Google Chrome prior to 150.0.7871.47 can be subverted by an attacker who has already achieved renderer process compromise, allowing site isolation to be bypassed via a crafted HTML page. The flaw (CWE-602: Client-Side Enforcement of Server-Side Security) enables manipulation of cross-origin content or policy in embedded browsing contexts that Chrome's site isolation architecture is designed to protect. No public exploit code has been identified and EPSS places exploitation probability at 0.22% (13th percentile), consistent with the elevated prerequisite of a prior renderer compromise required to trigger this vulnerability.
Technical ContextAI
GuestView is the Chromium subsystem responsible for hosting embedded web content, underpinning the <webview> tag used in Chrome packaged apps and extensions, as well as Electron-based applications. CWE-602 (Client-Side Enforcement of Server-Side Security) identifies the root cause as security policy decisions - which should be enforced by a privileged process - being insufficiently enforced within the renderer context, making them susceptible to manipulation once a renderer is attacker-controlled. Chrome's site isolation model assigns each origin its own renderer process to prevent cross-origin data access; GuestView introduces a distinct embedded-content security context with its own policy surface. The affected product range is Google Chrome on desktop platforms versions prior to 150.0.7871.47, as confirmed by EUVD-2026-40557 and the Chromium issue tracker (issues.chromium.org/issues/497961376). Chromium-based derivatives sharing this codebase may also carry the flaw pending their own upstream integration.
RemediationAI
Update Google Chrome to version 150.0.7871.47 or later immediately; this version is confirmed by the official Chrome stable channel advisory at chromereleases.googleblog.com to contain the fix. Chrome's built-in auto-update mechanism delivers this patch automatically on most desktop systems; enterprise administrators should verify deployment via Google Admin Console, Chrome Browser Cloud Management, or endpoint management tooling and enforce minimum version policy. If patching cannot be applied immediately, restricting or disabling Chrome extensions and packaged apps that embed <webview> tags (GuestView contexts) reduces the exploitable attack surface, though this may break functionality for kiosk applications or enterprise web apps relying on embedded browsing. Because exploitation requires a preceding renderer compromise, keeping Chrome fully patched against all current Chromium vulnerabilities is the most effective way to eliminate the attack chain entry point that would make this bypass reachable. Chromium-based browser vendors should be monitored for their own advisory releases incorporating the upstream fix.
Same technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today