Executive brief
Google Chrome contains an authorization flaw in its FileSystem component that allows attackers who have already compromised the browser's renderer process to bypass site isolation protections. An attacker could exploit this using a crafted PDF file to break Chrome's security boundary between websites, potentially exposing sensitive data from other open sites or applications.
Technical details
This is an incorrect authorization vulnerability in the FileSystem component of Google Chrome. The flaw allows a remote attacker who has already achieved renderer process compromise to bypass site isolation—Chrome's core security mechanism that isolates each website in a separate process. The attack is triggered via a crafted PDF file. Site isolation bypass is critical because it enables an attacker to access data and resources belonging to other sites open in the browser. The vulnerability was fixed in Chrome 153.0.8010.36, released on September 8, 2026. Exploitation requires prior renderer compromise, making this a secondary payload risk rather than a primary entry point.
Affected products
- Google Chrome prior to 153.0.8010.36
Timeline
- 2026-09-09: disclosed
- 2026-09-08: patched