EUVD-2026-42458
GHSA-wvr7-3cpq-c6mg
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Network delivery via crafted page (AV:N), no privileges needed (PR:N), user must visit page (UI:R), limited cross-origin read only (C:L), no write or availability impact confirmed.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Insufficient policy enforcement in Navigation in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Insufficient navigation policy enforcement in Google Chrome prior to 150.0.7871.115 enables site isolation bypass when a user visits a crafted HTML page. A remote, unauthenticated attacker (per CVSS PR:N) can exploit this to read limited cross-origin data, undermining Chrome's core renderer process separation architecture. No public exploit code or active exploitation has been identified; SSVC rates exploitation as none and technical impact as partial, consistent with the moderate CVSS 4.3 score.
Technical ContextAI
CWE-602 (Client-Side Enforcement of Server-Side Security) identifies the root cause: Chrome's Navigation subsystem fails to enforce isolation policies that are meant to guarantee strict origin separation. Chrome's Site Isolation feature routes content from distinct origins into separate renderer processes to prevent cross-origin data leakage - a defense-in-depth layer against Spectre-class attacks and cross-site data theft. When navigation policy checks are insufficiently enforced, a crafted HTML page can manipulate frame or tab navigation sequences to cause the browser to load cross-origin content within an attacker-controlled renderer context, partially defeating that boundary. The vulnerability was reported via chrome-cve-admin@google.com and assigned Chromium security severity High, reflecting the sensitivity of site isolation as a security primitive even when concrete data exposure is bounded.
RemediationAI
Update Google Chrome to version 150.0.7871.115 or later immediately via Settings > Help > About Google Chrome or through the vendor's stable channel release documented at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_01162222768.html. Patch availability is confirmed per vendor advisory. Enterprise administrators deploying Chrome via Google Admin Console should push the update through Chrome Browser Cloud Management policies without delay. If immediate update is not operationally feasible, restrict end-user access to untrusted external web content via corporate web proxy filtering as a temporary compensating control - this limits exposure but does not eliminate risk for users who must access external sites. Disabling JavaScript would block the crafted navigation trigger but renders most modern web applications non-functional and is not a viable general-purpose workaround.
Same technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today