EUVD-2026-33122
GHSA-6pj9-cg4h-v8ww
Severity by source
Sources disagree (Low–High)AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Insufficient validation of untrusted input in Printing in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Site isolation bypass in Google Chrome's Printing component (versions prior to 148.0.7778.216) enables an attacker who has already compromised the renderer process to escape cross-origin data boundaries via a crafted HTML page. The root cause is insufficient input validation (CWE-20) in the printing subsystem, which fails to properly sanitize renderer-supplied data before acting on it in a security-sensitive context. With an EPSS of 0.02% (6th percentile), no CISA KEV listing, and no public exploit identified at time of analysis, this functions primarily as a post-exploitation escalation primitive rather than an initial access vector.
Technical ContextAI
Google Chrome's site isolation architecture enforces same-origin policy at the process level, placing content from distinct origins in separate renderer processes to prevent cross-site data leakage. CWE-20 (Improper Input Validation) in the Printing component means that when a renderer process supplies input to the printing subsystem, Chrome does not adequately validate or sanitize that input before processing it in a privileged context. This breakdown allows a compromised renderer - which is already operating outside its intended trust boundary - to pass malformed or adversarial data through the printing interface and influence cross-origin state. The affected software is identified by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering all Chrome desktop builds prior to 148.0.7778.216. The Chromium security severity is rated High, reflecting the architectural significance of a site isolation bypass even under constrained conditions.
RemediationAI
The primary fix is to update Google Chrome to version 148.0.7778.216 or later; this patch is confirmed available via the Chrome stable channel update advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html. Chrome's built-in auto-update mechanism will deliver this version automatically in most enterprise and consumer deployments; administrators should verify rollout completion via fleet management tooling. Because exploitation requires a prior renderer compromise, organizations that enforce Chrome's built-in renderer sandbox hardening (--enable-features=StrictSiteIsolation is default on desktop) and keep Chrome current reduce the attack surface for chained exploits of this type. Disabling or restricting print functionality via enterprise policy (PrintingEnabled=false) would eliminate this specific vector as a compensating control where printing is non-essential, though this carries obvious operational trade-offs. No workaround fully substitutes for patching.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Low| Product | Status |
|---|---|
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today