EUVD-2026-40554
GHSA-525c-544m-43xw
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
AC:H reflects the mandatory prior renderer compromise; S:C reflects site isolation bypass crossing security domain boundaries between origins.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Inappropriate implementation in Network in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Site isolation bypass in Google Chrome on Android prior to 150.0.7871.47 enables a remote attacker - who has already achieved renderer process compromise via a separate exploit - to break cross-origin security boundaries using a crafted HTML page. The root cause is CWE-346 (Origin Validation Error) in Chrome's Android-specific network implementation, meaning the network layer fails to enforce origin checks when requests originate from a compromised renderer context. No active exploitation is confirmed (not in CISA KEV), and the EPSS score of 0.22% at the 13th percentile reflects the high chaining complexity required.
Technical ContextAI
Chrome's site isolation architecture places content from distinct origins into separate renderer processes to prevent cross-site data theft (e.g., Spectre mitigations, cross-origin read blocking). CWE-346 (Origin Validation Error) indicates the network stack on Android does not correctly validate that cross-origin network requests or navigations are legitimate when issued from a renderer process in a compromised state. The 'inappropriate implementation in Network' phrasing targets Android-specific network code paths, suggesting this is not a universal Chrome flaw but one specific to Android's platform integration. Affected CPE inferred from EUVD: all Chrome for Android releases below 150.0.7871.47. The vulnerability is a second-stage component in an exploit chain - it is not exploitable standalone.
RemediationAI
Update Google Chrome on Android to version 150.0.7871.47 or later - this is the vendor-confirmed fixed release per the Chrome stable channel advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Users on Android should verify their Chrome version in Settings > About Chrome and apply the update via Google Play Store. As a compensating control, organizations managing Android endpoints via MDM can restrict Chrome to the patched version using app version enforcement policies; disabling Chrome entirely and substituting an alternative browser is an option with significant usability trade-offs. Because exploitation requires a prior renderer compromise, hardening the renderer attack surface (e.g., disabling JavaScript for untrusted sites via Chrome site settings, avoiding untrusted web content on unpatched devices) reduces the likelihood of the prerequisite being met, though this is not a substitute for patching.
Same weakness CWE-346 – Origin Validation Error
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today