Executive brief
A vulnerability in the Google Chrome web browser could allow a remote attacker to bypass security boundaries that normally keep different websites isolated from one another. To exploit this, an attacker would first need to compromise the browser's rendering process, typically by tricking a user into visiting a malicious website. Successfully bypassing site isolation could allow an attacker to access data from other open websites or tabs, potentially compromising sensitive user information.
Technical details
An improper input validation vulnerability (CWE-20) exists in the Loader component of Google Chrome. The flaw allows a remote attacker who has successfully compromised the renderer process to bypass Site Isolation protections via a specially crafted HTML page. Site Isolation is a security feature that ensures pages from different websites are run in separate processes to prevent data leakage. By bypassing this, an attacker could potentially access sensitive information across different origins. This issue is resolved in Google Chrome version 149.0.7827.53.
Affected products
- Google Chrome prior to 149.0.7827.53
Timeline
- 2026-06-02: patched: Chrome 149.0.7827.53 released to stable channel.
- 2026-06-05: disclosed: CVE published.