EUVD-2026-34387
GHSA-4c9j-9xrp-5gqm
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Lifecycle Timeline
5DescriptionCVE.org
Inappropriate implementation in Input in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Site isolation bypass in Google Chrome prior to 149.0.7827.53 enables a remote attacker - who has already compromised the renderer process - to escape cross-origin protections via a crafted HTML page. The vulnerability stems from inappropriate handling of the Input component (CWE-20: Improper Input Validation) within Chromium's renderer, allowing crafted input to undermine the site isolation security boundary and produce high-integrity impact against cross-origin resources. No public exploit has been identified at time of analysis, and EPSS places exploitation probability at 0.02% (6th percentile), consistent with the renderer pre-compromise prerequisite that constrains standalone exploitation.
Technical ContextAI
Google Chrome's site isolation architecture places each website's renderer process in a sandboxed environment, preventing cross-origin memory, DOM, and network resource access between tabs and origins. This vulnerability exists within Chrome's Input handling subsystem inside the Chromium rendering engine. CWE-20 (Improper Input Validation) identifies the root cause as insufficient validation of input data within the renderer's Input component, allowing a crafted HTML page to manipulate boundary enforcement logic that underpins site isolation. The affected CPE (cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*) covers all desktop Chrome installations prior to 149.0.7827.53. Site isolation was designed as a defense-in-depth measure against renderer-level exploits, making bypasses like this particularly significant in the context of chained exploit scenarios.
RemediationAI
The primary fix is upgrading Google Chrome to version 149.0.7827.53 or later, released via the stable channel update and confirmed by the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Users should verify their current version via chrome://settings/help and allow auto-update to apply the patch. Enterprise administrators deploying Chrome via Google Admin Console or policy management should push version 149.0.7827.53 through their managed update channels immediately. For environments unable to patch immediately, the most targeted compensating control is enforcing strict Site Isolation via enterprise policy (SitePerProcess=enabled), though note this is already the default in modern Chrome - the gap is specifically in how Input handling behaves after renderer compromise, not in whether site isolation is configured. Additionally, monitoring for abnormal renderer crash patterns may surface exploit attempts. Disabling JavaScript for sensitive internal web applications reduces renderer attack surface but carries significant usability trade-offs. There are no known workarounds that fully mitigate this vulnerability without patching.
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac
Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, a
The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, do
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13
Same weakness CWE-20 – Improper Input Validation
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: High| Product | Status |
|---|---|
| openSUSE Tumbleweed | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today