EUVD-2026-54124
GHSA-2pjc-wr33-2rrg
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
AC:H reflects the mandatory chained renderer compromise prerequisite; S:C reflects that site isolation bypass affects cross-origin resources outside the vulnerable component.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Insufficient validation of untrusted input in Workers in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Site isolation bypass in Google Chrome Workers allows a remote attacker who has already compromised the renderer process to cross origin boundaries and access data from other sites via a crafted HTML page. All Chrome versions prior to 151.0.7922.109 are affected. EPSS sits at 0.26% (17th percentile) and SSVC confirms exploitation status as none, meaning no public exploit or active exploitation has been identified at time of analysis - the elevated CVSS of 8.1 reflects worst-case impact if this flaw is chained with a renderer exploit, rather than standalone exploitability.
Technical ContextAI
Google Chrome's site isolation architecture separates content from different origins into distinct renderer processes, preventing cross-origin data leakage. Web Workers (covered under CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*) are background JavaScript execution contexts that communicate with the main thread via message passing. CWE-20 (Improper Input Validation) is the root cause: the Workers subsystem fails to sufficiently validate untrusted input arriving from within a compromised renderer, allowing crafted messages to violate the site isolation boundary. This class of flaw is typically a second-stage exploit component - it converts renderer-level code execution into a cross-origin data access primitive by abusing insufficiently guarded IPC or postMessage pathways inside the Workers implementation.
RemediationAI
The primary remediation is upgrading Google Chrome to version 151.0.7922.109 or later, which contains the vendor-released patch. Chrome typically auto-updates, but administrators managing enterprise fleets should verify deployment via policy and confirm the update is applied. The advisory is published at https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_01193673229.html. As a compensating control where immediate patching is not possible, restricting access to untrusted web content via enterprise proxy filtering reduces exposure to the delivery mechanism (crafted HTML page), though this does not eliminate the underlying flaw. Disabling JavaScript or blocking Workers via Content Security Policy at a gateway level is operationally disruptive and not a viable general workaround. Because exploitation requires a compromised renderer as a prerequisite, any control that reduces renderer attack surface (e.g., enabling Chrome's strict site isolation policy via enterprise policy StrictOriginIsolation if not already the default) provides marginal additional defense-in-depth.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: CriticalShare
External POC / Exploit Code
Leaving vuln.today