Executive brief
Google Chrome is a widely used web browser. A vulnerability in its accessibility features could allow an attacker who has already partially compromised the browser to bypass critical security boundaries known as 'site isolation.' This could allow the attacker to access data from other websites or tabs, potentially leading to the theft of sensitive information or unauthorized actions across different web services.
Technical details
An improper input validation vulnerability (CWE-20) exists in the Accessibility component of Google Chrome. The flaw allows a remote attacker who has already achieved code execution within a compromised renderer process to bypass Site Isolation protections. By enticing a user to visit a specially crafted HTML page, the attacker can leverage this insufficient validation to escape the sandbox-like restrictions that normally prevent one site from accessing data from another. This vulnerability was addressed in version 150.0.7871.47.
Affected products
- Google Chrome prior to 150.0.7871.47
Timeline
- 2026-04-16: disclosed: Reported to Chrome by Google researchers
- 2026-06-30: patched: Fixed in version 150.0.7871.47
- 2026-06-30: advisory