EUVD-2026-40720
GHSA-mf8w-855x-826p
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Site isolation bypass implies a scope change (S:C) and cross-origin confidentiality exposure (C:H); I:L reflects constrained integrity manipulation potential against other origins.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Insufficient policy enforcement in Media in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium security severity: Low)
AnalysisAI
Site isolation bypass in Google Chrome's Media component on Windows allows remote attackers to circumvent cross-origin security boundaries by delivering a specially crafted HTML page to a victim. All Chrome for Windows releases prior to 150.0.7871.47 are affected. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; EPSS at 0.18% (8th percentile) and SSVC exploitation status of 'none' consistently indicate low current real-world risk despite the potential severity of an isolation bypass.
Technical ContextAI
The vulnerability resides in Chrome's Media component on Windows, where policy enforcement is implemented client-side rather than at the appropriate security boundary - a pattern classified under CWE-602 (Client-Side Enforcement of Server-Side Security). Chrome's site isolation architecture is designed to confine each renderer process to a single origin, preventing cross-site data leakage and mitigating Spectre-class side-channel attacks. The Media component's handling of attacker-controlled HTML content fails to correctly apply these isolation policies, allowing an attacker-controlled renderer to breach the boundary separating it from other origins. The EUVD entry (EUVD-2026-40720) and the Chromium issue tracker (https://issues.chromium.org/issues/495848160) corroborate this component-level scoping. The flaw is explicitly Windows-platform-specific, suggesting the policy gap exists in a Windows-only Media subsystem code path.
RemediationAI
The primary remediation is upgrading Google Chrome on Windows to version 150.0.7871.47 or later, which contains the vendor-released patch per Google's stable channel update advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Users should verify their installed version via chrome://settings/help and ensure automatic updates are enabled. For enterprise environments unable to immediately deploy the update, compensating controls include enforcing Chrome managed policies to restrict Media feature access via the ChromeMediaRouter and related policy settings, applying URL allowlists to limit navigation to trusted origins only, and ensuring Chrome's Site Isolation feature (chrome://flags/#enable-site-per-process) is active - though this alone may be insufficient against this specific bypass. Restricting access to untrusted external web content at the network perimeter reduces exposure surface until patching is complete. No workaround fully eliminates the vulnerability without the vendor patch.
Same technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today