EUVD-2026-40572
GHSA-pj3j-53c6-vxqw
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Network delivery and no attacker privileges required, but mandatory user interaction; integrity-only impact with no scope change or confidentiality/availability consequence.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Insufficient policy enforcement in Isolated Web Apps in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass content security policy via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Content Security Policy bypass in Google Chrome's Isolated Web Apps (IWA) subsystem allows remote attackers to circumvent enforcement mechanisms via a specially crafted HTML page, resulting in high-integrity impact with no confidentiality or availability consequence. Affected versions are all Chrome releases prior to 150.0.7871.47. User interaction is required - the victim must visit the attacker-controlled page - and no public exploit or CISA KEV listing has been identified at time of analysis. The low EPSS score of 0.22% (13th percentile) reinforces that active exploitation is not currently observed.
Technical ContextAI
Isolated Web Apps (IWAs) are a Chrome platform feature that grants installable web applications native-app-like isolation, elevated permissions, and tighter origin policies - including stricter Content Security Policy enforcement - compared to ordinary web pages. CWE-693 (Protection Mechanism Failure) identifies the root cause class: the browser's policy enforcement engine fails to correctly apply or propagate CSP restrictions within the IWA context, allowing a crafted HTML document to cause Chrome to treat disallowed sources or script execution as permitted. This is distinct from a standard CSP header misconfiguration; the flaw resides in how Chrome's IWA runtime enforces the policy internally. Affected CPE is Google Chrome prior to 150.0.7871.47 on desktop platforms.
RemediationAI
Update Google Chrome to version 150.0.7871.47 or later, which contains the vendor-released patch for this vulnerability per the Chrome stable channel advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Enterprise administrators using Chrome Browser Cloud Management or GPO-based update policies should verify the minimum version policy is set to 150.0.7871.47. For environments where immediate patching is not feasible, a compensating control is to restrict or block access to Isolated Web Apps in the Chrome enterprise policy via the IsolatedWebAppsEnabled policy flag - disabling IWA access removes the vulnerable code path entirely, though it will prevent legitimate IWA-based internal tools from functioning. Standard browser isolation solutions (e.g., remote browser isolation) do not mitigate this class of intra-browser policy bypass. No workaround short of disabling IWAs addresses the root enforcement flaw.
Same weakness CWE-693 – Protection Mechanism Failure
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today