EUVD-2026-93670
GHSA-5hq4-xh7f-23f4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCompromise renderer via separate bug
-
DeliveryServe crafted HTML page
-
ExploitTrigger missing authorization in Network
-
ExecutionBypass site isolation boundary
-
ImpactAccess cross-site resources
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to have ALREADY compromised a Chrome renderer process (a significant precondition, typically achieved via a separate chained vulnerability), plus victim interaction to load a crafted HTML page (UI:R). The specific target is Chrome's site-isolation security boundary, bypassed through a missing authorization check (CWE-862) in the Network component. Limiting factors: this is not a standalone remote-unauthenticated attack despite the PR:N CVSS metric - the renderer-compromise requirement and required user interaction substantially constrain realistic exploitation, and only Chrome versions prior to 155.0.8059.39 are affected. |
| Impact | Multiple signals converge on a MODERATE, deprioritizable risk rather than an urgent one. CISA SSVC reports Exploitation: none, Automatable: no, and only partial Technical Impact; EPSS is 0.18% (7th percentile), there is no CISA KEV listing, and no public exploit identified at time of analysis - all consistent with the vendor's 'Medium' Chromium severity and the 6.5 CVSS. The CVSS vector (AV:N/AC:L/PR:N/UI:R) appears to overstate ease of attack: the description explicitly requires an attacker 'who had compromised the renderer process' before exploitation, a substantial prerequisite the PR:N/AC:L metrics do not capture. This conflict should be noted - the flaw is not a standalone remote entry point but a second-stage site-isolation bypass used after an initial renderer compromise (e.g., chained from a separate RCE/sandbox bug). Impact is integrity-focused (C:N/I:H/A:N), reflecting a security-boundary bypass rather than direct data theft or crash. Net: real but low-priority for most defenders - patch in the normal Chrome auto-update cycle; it becomes meaningful only as part of an exploit chain. |
| Exploit ScenarioDerived | An attacker first compromises a Chrome renderer process (via a separate vulnerability) and then lures the victim into loading a crafted HTML page that triggers this missing-authorization flaw in the Network component to bypass site isolation, letting the already-compromised renderer access cross-site resources it should be walled off from. No public exploit is identified at time of analysis, and SSVC rates exploitation as 'none', so this is a theoretical chain-stage rather than an observed attack. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 10, 2026
Site isolation bypass in Google Chrome versions prior to 155.0.8059.39 allows an attacker who has already compromised a Chrome renderer process to escape Chrome's site-isolation security boundary by having the victim load a crafted HTML page, undermining the process-level compartmentalization that keeps data from different sites apart. The root cause is a missing authorization check (CWE-862) in Chrome's Network component, and Google rates the flaw Chromium security severity Medium; the CVSS vector is AV:N/AC:L/PR:N/UI:R with no confidentiality or availability impact but high integrity impact, while our independent assessment raises attack complexity to AC:H because the renderer-compromise precondition is substantial and the attack is not a standalone remote-unauthenticated path. Vendor-released patch: 155.0.8059.39, distributed through the Chrome stable channel; EPSS is 0.18% (7th percentile), SSVC records exploitation as 'none', and no public exploit identified at time of analysis, so this is a moderate, deprioritizable risk best handled in a normal patch cycle rather than an emergency response.
RemediationAI
Apply the Vendor-released patch: 155.0.8059.39 (or a later stable build) - deploy it through Chrome's auto-update mechanism, then verify on endpoints via chrome://version and force a relaunch of the browser, since Chrome applies updates only after restart; enterprise fleets should raise the minimum version floor in their update or configuration management tooling and check that no policy pin or update freeze keeps Chrome below 155.0.8059.39, as the fix details are documented at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html and https://issues.chromium.org/issues/498737756. Because exploitation additionally requires a pre-existing renderer compromise plus user interaction, compensating controls should harden that first stage rather than the bypass itself: keep Site Isolation enabled and avoid enterprise policies or command-line flags (for example SitePerProcess/IsolateOrigins opt-outs or --disable-site-isolation-trials) that weaken it, accepting the memory overhead that strict per-site process isolation imposes; block delivery of untrusted HTML (email attachments, drive-by web content) via web filtering and egress controls on renderer traffic, with the trade-off of added latency and false positives; and, where the risk appetite allows, enable stricter renderer hardening or reduce JIT exposure to make the preceding renderer RCE harder, accepting a measurable JavaScript performance cost. No public exploit identified at time of analysis and SSVC reports exploitation as 'none', so these compensating controls are appropriate only as a stopgap while standard-cycle patching completes, not as a substitute for reaching 155.0.8059.39.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Chrome's security model relies on multi-process isolation: each site is rendered in its own sandboxed renderer process, and the browser process enforces the same-origin policy at the process boundary via Site Isolation, so a compromised renderer is normally confined to the content of the site it rendered. CVE-2026-106267 is a missing authorization check (CWE-862) inside the Network component that handles requests for a renderer; because the check is absent, a renderer process that is already under attacker control can cause the browser-side network stack to act on requests it should refuse, effectively crossing the site-isolation boundary and letting content from one site influence or read another. The affected code is part of the Chromium open-source project shipped as Google Chrome, whose CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* (all versions), with ENISA EUVD listing the fixed boundary at 155.0.8059.39. The attack chain therefore has two stages - first a separate renderer-process compromise (typically another, separately patched vulnerability or a V8 exploit), then this authorization bypass triggered by a crafted HTML page the victim must load - which is why the assessed vector uses AC:H even though the CVSS base vector advertises PR:N/UI:R. References include Google's stable channel release notes and the Chromium issue tracker entry 498737756.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
AC:H because exploitation depends on a prior renderer compromise; UI:R for the crafted page; I:H for the site-isolation integrity bypass with no confidentiality or availability impact.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Missing authorization in Network in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB