EUVD-2026-28124Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
AC:H reflects the explicit renderer pre-compromise prerequisite; S:C captures site isolation bypass crossing security boundaries; A:N as no availability impact is described.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
Insufficient validation of untrusted input in SiteIsolation in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Low)
AnalysisAI
Site isolation bypass in Google Chrome (all versions prior to 148.0.7778.96) enables a remote attacker who has already achieved renderer process compromise to escape Chrome's cross-site data boundaries via a crafted HTML page. The flaw (CWE-20) lies in insufficient input validation within the SiteIsolation component, a critical security boundary that separates origin contexts. No active exploitation is confirmed by CISA KEV, EPSS is minimal at 0.02% (7th percentile), and SSVC classifies exploitation as none - marking this as a post-exploitation chaining primitive rather than a standalone attack vector.
Technical ContextAI
Chrome's Site Isolation architecture assigns each web origin to a distinct renderer process, enforcing a hard boundary that prevents cross-site data exfiltration even if one renderer is compromised. CWE-20 (Improper Input Validation) in this context means the SiteIsolation subsystem fails to sanitize or reject attacker-controlled input originating from a compromised renderer, allowing it to influence cross-origin resource handling in ways that breach the isolation guarantee. The affected CPE (cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*) covers all Chrome builds across platforms prior to 148.0.7778.96. Tags referencing Red Hat and SUSE indicate the vulnerability propagates into downstream Linux distribution packaging of Chromium.
RemediationAI
Vendor-released patch: Chrome 148.0.7778.96. Users should update to Chrome 148.0.7778.96 or later via Chrome's built-in auto-update mechanism or by downloading directly from the Google stable channel advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html. Red Hat and SUSE administrators should apply Chromium package updates through their respective distribution channels as they become available. Because exploitation requires a pre-compromised renderer as a prerequisite, organizations that enforce Chrome enterprise policies to block malicious site navigation - such as URL filtering, SafeBrowsing enforcement, and disabling high-risk extensions - reduce the likelihood of the renderer compromise precondition being achieved, though these are not substitutes for patching.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: MediumShare
External POC / Exploit Code
Leaving vuln.today