Executive brief
Google Chrome's SiteIsolation feature is a security mechanism that isolates web pages from different sites to prevent data theft. This vulnerability allows an attacker who has already compromised Chrome's rendering engine to bypass these protections and access privileged pages, potentially exposing user data or session information from other websites.
Technical details
This vulnerability is an incorrect authorization flaw in Chrome's SiteIsolation sandboxing mechanism. An attacker who has compromised the renderer process can craft a malicious HTML page to bypass site isolation boundaries and gain unauthorized access to privileged pages. The attack requires prior compromise of the renderer process (sandboxed execution context) rather than being exploitable from the network alone. Chrome 152.0.7977.65 and later versions contain the fix. This is a medium-severity issue in Chromium's classification, though reported with a lower CVSS score.
Affected products
- Google Chrome prior to 152.0.7977.65
Timeline
- 2026-08-25: disclosed
- 2026-08-25: patched: Chrome 152.0.7977.65 released