Executive brief
Google Chrome's FileAPI component contained a race condition that could allow an attacker with control over the browser's renderer process to bypass site isolation protections. Site isolation is a critical security boundary that prevents malicious websites from accessing data belonging to other websites; bypassing it could expose sensitive user information across multiple websites visited in the same browser session.
Technical details
A race condition exists in Chrome's FileAPI implementation prior to version 153.0.8010.36. The vulnerability requires an attacker to have already compromised the renderer process (a significant precondition), after which they can exploit the race condition via a crafted HTML page to circumvent the site isolation security model. Site isolation is a foundational defense that isolates each website into its own process; bypassing this boundary allows cross-site data access. The vulnerability was patched in Chrome 153.0.8010.36 released on September 8, 2026.
Affected products
- Google Chrome prior to 153.0.8010.36
Timeline
- 2026-09-08: disclosed
- 2026-09-08: patched: Chrome 153.0.8010.36 released