EUVD-2026-35253
GHSA-5cc5-fjm9-c96q
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Lifecycle Timeline
4DescriptionNVD
Inappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Site isolation bypass in Google Chrome Extensions (versions prior to 149.0.7827.103) enables a remote attacker who has already compromised the renderer process to escape cross-origin content boundaries via a crafted HTML page. The vulnerability stems from improper input validation (CWE-20) in the Extensions subsystem, producing a high integrity impact (I:H) with no confidentiality or availability loss per the CVSS vector. No public exploit code exists and no active exploitation has been confirmed, with EPSS at 0.02% (6th percentile), consistent with a chained, high-complexity attack path.
Technical ContextAI
Google Chrome's site isolation architecture partitions web content across separate renderer processes to enforce cross-origin security boundaries. The affected component is the Extensions subsystem, which interfaces with renderer process privileges to provide extension APIs. CWE-20 (Improper Input Validation) as the root cause indicates that crafted input - delivered via a specially constructed HTML page - is not properly validated within the Extensions implementation, allowing it to influence cross-origin boundaries it should not be able to reach. Affected CPE is implicitly Google Chrome prior to version 149.0.7827.103 on all supported desktop platforms (Windows, macOS, Linux), as confirmed by the EUVD affected versions range 'Chrome 149.0.7827.103 < 149.0.7827.103' and the Chrome Stable Channel release advisory.
RemediationAI
The primary fix is upgrading Google Chrome to version 149.0.7827.103 or later, which is the vendor-confirmed patched release documented in the Chrome Stable Channel advisory at chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html. Chrome typically applies updates automatically when the browser is restarted; administrators managing enterprise deployments should push the update via Google Admin Console or equivalent MDM tooling. If immediate upgrade is not feasible, a targeted compensating control is disabling or tightly restricting browser extensions to a vetted allowlist via enterprise policy, which limits the attack surface of the vulnerable Extensions subsystem; note that this may break legitimate extension-dependent workflows. Additionally, since the attack chain requires prior renderer process compromise, prioritizing any other outstanding Chrome renderer vulnerabilities for patching reduces the precondition likelihood. No additional workarounds are documented in the referenced advisories.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today