EUVD-2026-33152
GHSA-9jr4-r64p-fhqf
Severity by source
Sources disagree (Low–High)AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Inappropriate implementation in Input in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Site isolation bypass in Google Chrome for Android (prior to 148.0.7778.216) enables a remote attacker who has already achieved renderer process compromise to cross Chrome's site isolation boundary via a specially crafted HTML page. The flaw resides in the Input handling component (CWE-346: Origin Validation Error), where improper implementation fails to enforce origin boundaries adequately within the renderer context on Android. No public exploit code exists and no active exploitation has been identified at time of analysis; EPSS is 0.02% (4th percentile) and SSVC rates exploitation as none - consistent with the high-complexity, chained-attack prerequisites.
Technical ContextAI
Google Chrome's site isolation is a defense-in-depth mechanism that confines each renderer process to a single site's origin, preventing cross-origin data access even if one renderer is compromised. CWE-346 (Origin Validation Error) indicates that the Input subsystem - responsible for routing user or programmatic input events within the browser - improperly validates the origin context when handling input in a compromised renderer on Android. The Android-specific surface is notable: Chrome on Android uses a different process model and IPC path from desktop, which may expose origin checks that desktop builds enforce differently. The affected CPE (cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*) covers all Chrome versions prior to 148.0.7778.216 on Android without additional qualifier, suggesting the flaw is architectural to the Android Input implementation rather than version-specific regression.
RemediationAI
Update Google Chrome for Android to version 148.0.7778.216 or later, which contains the vendor-released patch as confirmed by the Chrome Stable Channel advisory (http://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html). Updates are available via the Google Play Store or Chrome's built-in update mechanism. Because exploitation requires a prior renderer compromise, organizations unable to immediately patch should prioritize ensuring Chrome is not running in modes that reduce renderer sandboxing (e.g., avoid disabling the Android sandbox via developer flags). Additionally, restricting access to untrusted or attacker-controlled web content through network-level controls or enterprise browser policies reduces the delivery surface for the initial renderer exploit that this vulnerability depends on as a second stage.
Same weakness CWE-346 – Origin Validation Error
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: LowShare
External POC / Exploit Code
Leaving vuln.today