EUVD-2026-42460
GHSA-mmx7-9gvj-j7gm
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Network-delivered via crafted page (AV:N, AC:L), no attacker privileges needed (PR:N), but victim must visit the page (UI:R); bypass yields limited cross-origin read only (C:L, I:N, A:N, S:U).
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Inappropriate implementation in Navigation in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Site isolation bypass in Google Chrome prior to 150.0.7871.115 enables remote attackers to read cross-origin data by delivering a crafted HTML page that exploits improper input validation in the browser's Navigation subsystem. Exploitation requires user interaction - the victim must visit the attacker-controlled page (UI:R in CVSS) - but no authentication or special privileges are needed from the attacker. No active exploitation is confirmed (SSVC Exploitation: none, no CISA KEV entry) and EPSS stands at just 0.19% (8th percentile), placing this firmly in the standard patch-cycle tier despite Chrome's ubiquitous deployment.
Technical ContextAI
Google Chrome's site isolation feature separates web content from distinct origins into separate renderer processes, forming a critical defense-in-depth layer against cross-site data exfiltration. The Navigation subsystem handles URL parsing, page transitions, and origin assignment during browsing. CWE-20 (Improper Input Validation) is the root cause class - Chrome fails to correctly validate or process navigation inputs triggered by a crafted HTML page, allowing an attacker to manipulate navigational context in a way that undermines origin boundaries enforced by site isolation. CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* confirms all Chrome desktop versions prior to 150.0.7871.115 are affected. Site isolation bypasses are particularly significant because they can enable an attacker renderer process to access data belonging to a victim's authenticated sessions on unrelated origins.
RemediationAI
Update Google Chrome to version 150.0.7871.115 or later - this is the vendor-released patch confirmed by the stable channel release advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_01162222768.html. Updates can be applied via Settings > Help > About Google Chrome or through enterprise deployment tools such as Google Admin console policies or MSI/PKG package distribution. No documented workarounds are available for the site isolation bypass itself; disabling Navigation features is not feasible without breaking core browser functionality. For organizations that cannot update immediately, restricting end-user access to untrusted external web content via a web proxy or content filter reduces exposure, though this limits browsing capability. Enterprise Chrome policies enforcing automatic updates (ChromeVariationsEnabled, RelaunchNotification) are the most actionable compensating control. Given SSVC Automatable: none and EPSS at 0.19%, this fits standard patch cadence rather than emergency deployment.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today