EUVD-2026-50785
GHSA-hv4h-ff48-p67r
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver renderer exploit via crafted web content
-
DeliveryGain code execution in Chrome renderer process
-
ExploitServe malicious HTML page triggering SiteIsolation flaw
-
ExecutionBypass cross-origin isolation boundary
-
PersistAccess sensitive data from victim's other open origins
-
ImpactExfiltrate credentials or session tokens
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V15 - Secure Coding and Architecture Protection mechanism completeness
|
| Exploitation Conditions | Exploitation requires that the attacker has already achieved code execution within the Chrome renderer process via a separate, independent vulnerability - this precondition is explicit in the CVE description ('remote attacker who had compromised the renderer process'). Beyond renderer compromise, the victim must interact with a crafted HTML page (UI:R per CVSS), requiring some form of delivery mechanism (phishing, malvertising, watering hole). No special Chrome configuration, flag, or feature enablement is required beyond the renderer compromise precondition. Exploitation is limited to Chrome versions prior to 151.0.7922.72. The unchanged scope (S:U) means the attack does not escape Chrome to the host operating system, limiting impact to within-browser cross-origin data access. These conditions collectively mean this vulnerability cannot be exploited in isolation - it requires chaining with a separate renderer exploitation primitive. |
| Impact | The CVSS 3.1 base score of 4.2 (Medium) with vector AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N accurately captures the constrained exploitation path: while the attack is network-delivered and requires no privileges on the target system, high attack complexity (AC:H) is justified by the mandatory renderer pre-compromise prerequisite, and user interaction (UI:R) requires the victim to visit a crafted page. EPSS at 0.30% (23rd percentile) aligns with the low probability of real-world standalone exploitation. No CISA KEV listing and no public POC code have been identified, further supporting a low immediate priority rating. The unchanged scope (S:U) indicates the vulnerability does not escape to the OS level. This CVE is most relevant as a link in a full browser exploit chain (renderer exploit + site isolation bypass + data exfiltration), making it a priority primarily for high-value targets under active threat from sophisticated actors. For the general enterprise population, patch urgency is moderate. Note: the vendor-assigned CVSS uses S:U, but a case for S:C exists given that site isolation boundaries separate distinct security contexts - this ambiguity is noted explicitly below. |
| Exploit ScenarioDerived | An attacker first exploits a separate renderer-level vulnerability in Chrome (such as a V8 type confusion or heap overflow) to gain code execution within the renderer process, then serves the victim a crafted HTML page that triggers the SiteIsolation implementation flaw to escape the per-origin isolation boundary, allowing the compromised renderer to read sensitive data (cookies, tokens, page content) from a different origin open in the same browser session. No public proof-of-concept code for this specific CVE has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Site isolation bypass in Google Chrome allows a remote attacker who has already compromised the renderer process to escape cross-origin boundaries via a crafted HTML page, potentially accessing data from other open origins within the browser. All Chrome desktop versions prior to 151.0.7922.72 are affected. The CVSS 4.2 (Medium) with AC:H reflects that this is a second-stage exploitation primitive requiring prior renderer compromise, not a standalone initial access vector; no public exploit or CISA KEV listing has been identified at time of analysis.
RemediationAI
Update Google Chrome to version 151.0.7922.72 or later, which contains the vendor-confirmed patch. Chrome typically applies updates automatically; administrators can verify or force the update via chrome://settings/help. The stable channel advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html provides the authoritative patch confirmation. Because exploitation requires a renderer pre-compromise as a prerequisite, organizations with managed Chrome deployments can reduce the broader attack chain risk by enforcing Chrome enterprise policies that restrict navigation to untrusted URLs and enable enhanced Safe Browsing, reducing the likelihood of the renderer being compromised in the first place. Disabling JavaScript is an extreme compensating control that breaks most web functionality and is not recommended as a general mitigation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Site Isolation is a core Chrome security architecture that confines each website's content to a dedicated renderer process, preventing cross-origin data access even when one renderer is compromised. CWE-693 (Protection Mechanism Failure) identifies the root cause as an inappropriate implementation in the SiteIsolation subsystem - specifically a logic flaw that fails to enforce isolation boundaries correctly under adversarial conditions. The CPE string cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covers all Google Chrome desktop releases prior to 151.0.7922.72 across Windows, macOS, and Linux. The Chromium issue tracker entry (issues.chromium.org/issues/495463654) is the upstream bug reference, though its public accessibility is unconfirmed.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
S:C assigned because site isolation bypass by definition crosses enforced security boundaries between origins; all other metrics align with the provided vector.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Inappropriate implementation in SiteIsolation in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: High)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-693 – Protection Mechanism Failure
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB