Executive brief
Google Chrome's Network component contains an incorrect authorization vulnerability that allows a compromised renderer process to bypass Chrome's site isolation security feature via a malicious HTML page. Site isolation is a critical security boundary that prevents websites from accessing sensitive data from other websites. An attacker who compromises the renderer process could escape this sandbox and access cross-site data or perform unauthorized operations.
Technical details
The vulnerability is an incorrect authorization flaw in Google Chrome's Network component affecting versions prior to 152.0.7977.65. The root cause lies in improper authorization checks that fail to enforce site isolation boundaries when handling network requests. An attacker who has already compromised the renderer process (via a separate exploit or vulnerability) can craft a malicious HTML page to trigger the authorization bypass. This allows the attacker to access resources and data from other websites that should be isolated. The vulnerability requires a prior renderer process compromise, reducing its severity; it is fixed in Chrome 152.0.7977.65 and later.
Affected products
- Google Chrome prior to 152.0.7977.65
Timeline
- 2026-08-25: disclosed
- 2026-08-25: patched: Fixed in Chrome 152.0.7977.65