EUVD-2026-50728
GHSA-f9xc-4vwc-v58g
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
Site isolation bypass is a confidentiality concern only; no integrity or availability mechanism is identifiable from the description, so A:N.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
5DescriptionCVE.org
Inappropriate implementation in Site Isolation in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Site Isolation bypass in Google Chrome prior to 151.0.7922.72 allows a remote unauthenticated attacker to circumvent the browser's cross-origin process isolation boundary by luring a user to a specially crafted HTML page. The flaw produces partial confidentiality loss - limited cross-origin data exposure - with no integrity impact and constrained scope (S:U per CVSS). No public exploit code exists, CISA SSVC confirms exploitation status as 'none,' and EPSS sits at 0.22% (13th percentile), collectively indicating low near-term exploitation probability despite the ubiquitous deployment footprint of Chrome.
Technical ContextAI
Site Isolation is a Chromium security architecture that assigns each web origin its own renderer process, preventing cross-origin memory reads and Spectre-class side-channel attacks. CWE-693 (Protection Mechanism Failure) identifies the root cause: a flaw in the implementation logic of Site Isolation itself - not a bypass of a peripheral control, but a defect in the core isolation mechanism. The CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* confirms all Chrome builds across Windows, macOS, and Linux prior to 151.0.7922.72 are within scope. The Chromium bug tracker reference (issues.chromium.org/issues/513478933) is the upstream issue, though its contents are likely restricted per standard Chrome security policy. The 'inappropriate implementation' language used by Google typically indicates incorrect enforcement of a security invariant - such as incorrect process assignment for a particular frame type, navigation case, or origin condition - rather than a full architectural hole.
RemediationAI
Update Google Chrome to version 151.0.7922.72 or later - the vendor-released patch confirmed by the stable channel advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. On consumer endpoints, Chrome's auto-update mechanism will apply the fix without user action beyond restarting the browser. Enterprise administrators using Chrome Browser Cloud Management or Group Policy should verify the managed fleet has received 151.0.7922.72 via the chrome://policy or chrome://version endpoints. No documented workaround exists for this Site Isolation implementation flaw; disabling Site Isolation (via --disable-site-isolation-trials flag) would eliminate the attack surface but would also remove Spectre mitigations and is strongly contraindicated in production environments. The patch is the only advisable remediation path.
Same weakness CWE-693 – Protection Mechanism Failure
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today