Executive brief
Lighthouse is a performance and quality auditing tool built into Google Chrome. A missing authorization check could allow a remote attacker who has already compromised the browser's rendering process to bypass site isolation protections through social engineering, potentially exposing data from other websites or web applications the user visits.
Technical details
The vulnerability is a missing authorization check in Lighthouse (Chrome's built-in auditing tool). The attack requires two preconditions: the attacker must have compromised the renderer process AND successfully use social engineering to trick the user. The flaw allows bypassing Chrome's site isolation security boundary, which normally prevents malicious content in one tab from accessing data in other tabs or websites. The vulnerability was patched in Chrome 152.0.7977.65 and later versions. Chromium classified this as Medium severity, though the reported CVSS score is 3.1 (low).
Affected products
- Google Chrome prior to 152.0.7977.65
Timeline
- 2026-08-25: disclosed
- 2026-08-25: patched: Fixed in Chrome 152.0.7977.65