EUVD-2026-40552
GHSA-4wj6-h6wx-47r8
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
AC:H because prior renderer compromise is required; S:C and C:H because site isolation bypass enables read access to cross-origin data, constituting a scope change.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Inappropriate implementation in Input in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Site isolation bypass in Google Chrome for Android (prior to 150.0.7871.47) allows a remote attacker who has already achieved renderer process compromise to cross origin boundaries using a crafted HTML page, enabling high-integrity impact against other open sites. The root cause is CWE-20 (Improper Input Validation) within Chrome's Input subsystem on Android - an input handling implementation flaw that fails to enforce cross-origin separation once the renderer is under adversary control. No public exploit has been identified at time of analysis and EPSS sits at 0.22% (13th percentile), placing this firmly in the category of a meaningful escalation primitive rather than a standalone mass-exploitation risk.
Technical ContextAI
Google Chrome's site isolation architecture assigns each distinct web origin to a separate renderer process to prevent cross-origin data leakage, a defense-in-depth layer especially critical on Android where the attack surface is broad. CWE-20 (Improper Input Validation) in Chrome's Input handling subsystem on Android allows a crafted HTML page to feed malformed input that the renderer processes without adequate cross-origin enforcement, permitting the already-compromised renderer to step outside its isolation boundary. The EUVD entry EUVD-2026-40552 and the Chromium issue tracker entry (issues.chromium.org/issues/497207698) confirm the scope to Android-specific Chrome builds; desktop Chrome is not cited as affected. The affected CPE range covers Chrome for Android versions below 150.0.7871.47, consistent with the EUVD affected-version data. This class of site isolation bypass is distinct from a direct renderer exploit - it is a second-stage capability that amplifies an existing compromise.
RemediationAI
Update Google Chrome for Android to version 150.0.7871.47 or later, which is the vendor-released patch per the Chrome stable channel advisory at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Chrome on Android typically auto-updates via the Google Play Store, so verifying that auto-update is enabled and not suppressed by device policy is the primary action for most users. For enterprise Android fleets managed via EMM or MDM, push the forced update via managed Chrome policy and confirm version compliance through your device management console. If immediate patching is blocked - for example, by app freeze policies - enforce strict Safe Browsing controls via Chrome enterprise policy to reduce the likelihood of a renderer-stage exploit that would be required to chain into this flaw; note that Safe Browsing restrictions degrade browsing usability and are not a substitute for the patch. No workarounds exist that fully mitigate site isolation bypass without the underlying code fix.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today