EUVD-2026-33198
GHSA-5f28-4vhp-7f3h
Severity by source
Sources disagree (Low–High)AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Insufficient validation of untrusted input in Site Isolation in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted MHTML page. (Chromium security severity: High)
AnalysisAI
Site Isolation bypass in Google Chrome prior to 148.0.7778.216 enables a remote attacker - who has already compromised the renderer process - to escape cross-origin protections by delivering a crafted MHTML page. Rooted in CWE-20 (Improper Input Validation) within Chrome's Site Isolation subsystem, successful exploitation yields limited confidentiality, integrity, and availability impact across cross-origin content boundaries. No public exploit code has been identified and no CISA KEV listing exists; EPSS sits at 0.02% (6th percentile), consistent with a constrained, multi-prerequisite attack chain rather than widespread opportunistic exploitation.
Technical ContextAI
Chrome's Site Isolation architecture places content from distinct origins into separate renderer processes, enforcing cross-origin access restrictions at the process boundary. This vulnerability (CWE-20, Improper Input Validation) manifests in the Site Isolation subsystem's handling of MHTML (MIME HTML) archive files - a format that bundles multiple web resources into a single serialized document. Crafted MHTML can confuse origin-assignment logic during parsing because the format's internal resource references may be improperly validated against the expected origin context, allowing a renderer that has already been compromised to misrepresent or escape its assigned origin boundary. The CPE string cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covers all desktop Chrome versions prior to 148.0.7778.216 across Windows, macOS, and Linux. This is a second-stage isolation bypass rather than a standalone initial compromise vector.
RemediationAI
The primary fix is to upgrade Google Chrome to version 148.0.7778.216 or later, as confirmed by the vendor advisory at the Chrome Releases blog (https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html). Chrome's automatic update mechanism should deliver this to consumer endpoints without intervention; enterprise administrators should verify rollout status through Google Admin Console, Chrome Browser Cloud Management, or equivalent fleet management tooling and push the update actively if auto-update is deferred. As a compensating control prior to patching, restricting the opening of MHTML (.mht and .mhtml) files via browser policy (e.g., Chrome's FileTypePolicies or endpoint DLP rules) or perimeter file-type filtering reduces the specific delivery mechanism for this vulnerability, though this may break legitimate MHTML archiving workflows and is not a substitute for patching. Additionally, ensuring Chrome's built-in sandbox remains enabled - avoiding any --no-sandbox launch flags in enterprise configurations - limits the feasibility of the prerequisite renderer compromise that this vulnerability chains from.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Low| Product | Status |
|---|---|
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today