EUVD-2026-40605
GHSA-5r9j-qw98-xg49
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
AC:H reflects mandatory renderer-compromise prerequisite; S:C and C:H reflect that site isolation bypass exposes cross-origin data, contradicting the vendor's C:N.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Insufficient policy enforcement in Extensions in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Site isolation bypass in Google Chrome prior to 150.0.7871.47 enables a remote attacker who has already compromised the renderer process to circumvent extension policy enforcement and escape site isolation boundaries via a crafted HTML page. The root cause (CWE-602) is client-side enforcement of security policies in the Extensions subsystem that can be subverted once the renderer is under attacker control. No active exploitation has been confirmed - EPSS is 0.22% (13th percentile), SSVC rates exploitation as none and the attack as non-automatable - and a vendor-released patch is available in Chrome 150.0.7871.47.
Technical ContextAI
Google Chrome's multi-process architecture isolates web content in sandboxed renderer processes, with site isolation as a core defense against cross-origin data leakage (Spectre mitigations, CORB, etc.). The Extensions framework enforces policies - such as which origins a renderer can interact with - partially via client-side checks within the renderer itself. CWE-602 (Client-Side Enforcement of Server-Side Security) describes exactly this failure mode: security decisions that must be enforced by a trusted component are instead delegated to an untrusted one. When a renderer process is already compromised, an attacker controlling that process can craft HTML interactions that violate extension policy enforcement, bypassing the site isolation guarantees that prevent cross-origin data access. CPE data from EUVD confirms the affected product as Chrome versions prior to 150.0.7871.47 on desktop platforms.
RemediationAI
Update Google Chrome to version 150.0.7871.47 or later, which contains the vendor-released patch per the stable channel advisory at chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Chrome typically auto-updates; administrators managing fleets via enterprise policy should confirm the update has propagated and verify the installed version via chrome://settings/help. Because exploitation requires a prior renderer compromise, organizations running Chrome at scale should also prioritize patching any concurrently disclosed renderer-level vulnerabilities - this flaw amplifies the impact of renderer RCE but does not introduce a standalone attack path. No workaround short of disabling Chrome extensions entirely (which would be highly disruptive) meaningfully mitigates this specific policy enforcement gap; the patch is the only targeted fix.
Same technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today