Executive brief
A security vulnerability in Google Chrome's extension system could allow a malicious website to bypass critical security boundaries. If a user visits a specially crafted page, an attacker who has already gained partial control over the browser's rendering process could access data from other websites or interfere with other open tabs. This bypasses 'Site Isolation,' a primary defense mechanism designed to keep data from different websites separate and secure.
Technical details
An inappropriate implementation vulnerability exists in the Extensions component of Google Chrome. The flaw allows a remote attacker who has already compromised the renderer process to bypass Site Isolation protections. By utilizing a specially crafted HTML page, the attacker can break the process-level boundaries that normally prevent one website from accessing data from another. This is classified as improper input validation (CWE-20) within the extension framework. The vulnerability is addressed in Google Chrome version 149.0.7827.103.
Affected products
- Google Chrome prior to 149.0.7827.103
Timeline
- 2026-05-14: disclosed: Reported by Google internal researchers
- 2026-06-08: patched: Fixed in Stable Channel Update 149.0.7827.102/.103
- 2026-06-09: advisory: NVD publication date