Executive brief
Google Chrome's SiteIsolation security feature prevents websites from accessing data from other sites by isolating them in separate processes. This vulnerability allows an attacker to bypass that isolation through social engineering and a crafted web page, potentially exposing cross-site data to compromise. While the attack requires the attacker to have already compromised the rendering process, the bypass undermines one of Chrome's core security boundaries.
Technical details
This is an authorization bypass in Chrome's SiteIsolation mechanism, a key security architecture that enforces process isolation between websites. The vulnerability resides in the SiteIsolation component and allows a remote attacker to bypass site isolation if they have already compromised the renderer process and leverage social engineering via a crafted HTML page. The attack vector requires both renderer process compromise and user interaction (social engineering), but once exploited, permits unauthorized cross-site data access. The issue was patched in Chrome 152.0.7977.65 released on 2026-08-25.
Affected products
- Google Chrome prior to 152.0.7977.65
Timeline
- 2026-08-25: disclosed
- 2026-08-25: patched: Fixed in Chrome 152.0.7977.65