Executive brief
Google Chrome's SiteIsolation feature is a security mechanism that isolates web pages from different sites in separate processes to prevent data theft. A vulnerability in this feature allowed an attacker who had already compromised Chrome's renderer process to bypass site isolation protections using a crafted HTML page, potentially enabling access to sensitive data from other websites the user visits.
Technical details
The vulnerability is an incorrect authorization check in Google Chrome's SiteIsolation feature (prior to version 152.0.7977.65). SiteIsolation is a fundamental security architecture that isolates renderer processes by site origin. The flaw allows an attacker who has already gained code execution in a compromised renderer process to bypass this isolation via a crafted HTML page. This vulnerability requires a prior renderer compromise as a precondition but could enable cross-site data access once successful. The fix is available in Chrome 152.0.7977.65 and later versions.
Affected products
- Google Chrome prior to 152.0.7977.65
Timeline
- 2026-08-25: disclosed
- 2026-08-25: patched: Fixed in Chrome 152.0.7977.65