Executive brief
Google Chrome's Core component contains an information leak vulnerability that allows attackers who have compromised the renderer process to bypass site isolation protections through a crafted HTML page. Site isolation is a critical security feature that prevents websites from accessing each other's sensitive data. This vulnerability could lead to data theft and cross-site attacks if exploited by an attacker with renderer process compromise.
Technical details
This is an information leak vulnerability in the Core component of Google Chrome that allows an attacker with an already-compromised renderer process to bypass site isolation via a crafted HTML page. Site isolation is a defense-in-depth mechanism that isolates web pages from different sites into separate renderer processes to prevent one compromised site from accessing another's data. The vulnerability requires the renderer process to already be compromised, making this a secondary exploit condition. Successful exploitation allows information to leak across site boundaries that should be protected by isolation guarantees. The vulnerability was patched in Chrome 152.0.7977.65 released on August 25, 2026.
Affected products
- Google Chrome prior to 152.0.7977.65
Timeline
- 2026-08-25: disclosed
- 2026-08-25: patched: Chrome 152.0.7977.65