EUVD-2026-50812
GHSA-v45v-wj9p-hx85
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCompromise Chrome renderer process
-
DeliveryServe crafted HTML page
-
ExploitTrigger input-validation flaw in Passwords
-
ExecutionBypass Site Isolation boundary
-
ImpactRead cross-origin data/credentials
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | Exploitation requires that the attacker has ALREADY compromised the Chrome renderer process - this is an explicit prerequisite in the CVE description, not a network-facing entry point - and then delivers a crafted HTML page to bypass Site Isolation; the CVSS UI:R metric means the victim must load attacker-controlled content. Limiting factors: the vulnerability is only present in Chrome Desktop before 151.0.7922.72, it needs the renderer-compromise foothold (typically a chained second bug), and it grants no availability impact. It is therefore a sandbox/boundary bypass usable as a chain link, not a standalone unauthenticated remote compromise despite the PR:N in the base vector. |
| Impact | The signals are mixed and point to a genuine-but-conditional risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N, score 8.1) reflects high confidentiality and integrity impact with no availability effect, but the base metrics understate a critical precondition stated in the description: the attacker must already have compromised the renderer process, so this is realistically the second stage of an exploit chain rather than a standalone remote attack. That aligns with SSVC (Exploitation: none, Automatable: no, Technical Impact: total) and with the low EPSS of 0.30% (23rd percentile), indicating no observed exploitation and low near-term probability. There is no CISA KEV listing and no POC identified. Net: a High-severity defense-in-depth bypass worth patching promptly, but not an emergency drive-by threat on its own - its danger is amplified only when paired with a separate renderer RCE. |
| Exploit ScenarioDerived | An attacker first exploits a separate memory-corruption bug to gain control of a Chrome renderer process, then uses that foothold to serve a crafted HTML page that abuses the Passwords input-validation flaw to slip past Site Isolation and read cross-origin data such as saved passwords or other sites' content. Given UI:R, the victim must load attacker-influenced content, and no public exploit is currently identified, so this would be part of a bespoke exploit chain rather than commodity malware. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Site isolation bypass in Google Chrome prior to 151.0.7922.72 lets a remote attacker who has already compromised the renderer process read or tamper with data belonging to other origins by serving a crafted HTML page, defeating one of Chrome's core sandbox boundaries. Chromium rates the severity High and a fixed Stable-channel build has shipped; there is no public exploit identified at time of analysis and EPSS is low at 0.30% (23rd percentile). The flaw is an input-validation weakness (CWE-20) in the Passwords component that undermines the per-site process separation guarantee.
RemediationAI
Vendor-released patch: Google Chrome 151.0.7922.72; upgrade all Desktop Chrome installations to 151.0.7922.72 or later and restart the browser to apply, verifying via chrome://settings/help and the Stable Channel advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. In managed environments, push the update through your enterprise update policy or MDM and confirm auto-update is not disabled. Because exploitation requires a pre-compromised renderer, interim compensating controls should focus on reducing renderer-compromise exposure: keep Chrome auto-updates enabled, restrict high-risk browsing, and consider enabling stricter enterprise policies (for example Site Isolation enforcement and reduced use of unvetted extensions); note these reduce but do not eliminate exposure and are no substitute for the version upgrade.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Site Isolation is Chrome's security architecture that places documents from different sites into separate renderer processes so that a single compromised renderer cannot reach cross-origin data such as saved credentials, cookies, or DOM content. This vulnerability lives in the Passwords subsystem and stems from insufficient validation of untrusted input (CWE-20), which allows a malicious document to cross the process/origin boundary that Site Isolation is meant to enforce. The affected code is the Chrome browser application itself (cpe:2.3:a:google:chrome), so the issue is in the browser engine (Chromium/Blink) rather than any external library, and it is exploitable only once an attacker controls a renderer, making it a boundary-hardening bug rather than an initial-access primitive.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Requires a pre-compromised renderer foothold (PR:L) plus chained conditions (AC:H) and victim loading content (UI:R); yields high confidentiality/integrity loss with no availability impact.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Insufficient validation of untrusted input in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: High)
Articles & Coverage 1
Executive ViewAI
Google Chrome versions prior to 151.0.7922.72 contain a site isolation bypass vulnerability that could allow attackers to read and modify sensitive data across different websites. Organizations running Chrome browsers face potential exposure of confidential information across user sessions. Vendor-released patch is available and should be deployed immediately.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-20 – Improper Input Validation
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB