Executive brief
Google Chrome's Site Isolation feature, which prevents malicious websites from stealing data from other sites, contains an authorization flaw. An attacker who has already compromised Chrome's rendering engine can bypass these protections and access data from other websites by tricking users into opening a specially crafted file, potentially leading to unauthorized access to sensitive information across multiple websites.
Technical details
This vulnerability is an incorrect authorization flaw in Chrome's SiteIsolation security architecture. The vulnerability requires two preconditions: the attacker must have already compromised the renderer process, and they must use social engineering to convince a user to open a crafted file. The vulnerability allows a compromised renderer to bypass site isolation boundaries, enabling cross-site data access. The flaw was patched in Chrome 153.0.8010.36 and later versions. The Chromium project classified this as medium severity, though it has been assigned a CVSS score of 8.8.
Affected products
- Google Chrome prior to 153.0.8010.36
Timeline
- 2026-09-09: disclosed
- 2026-09-08: patched: Chrome 153.0.8010.36 released to stable channel