Executive brief
Google Chrome's SiteIsolation feature, a core security mechanism that isolates web pages from different sites to prevent data theft, contains a missing authorization vulnerability. An attacker who has already compromised Chrome's rendering process could exploit this flaw via a malicious web page to break out of SiteIsolation and access data from other websites, potentially stealing sensitive information from multiple sites within a single session.
Technical details
This vulnerability is a missing authorization flaw in Google Chrome's SiteIsolation mechanism, which is designed to isolate renderer processes per site. A remote attacker who has already compromised the renderer process can bypass site isolation protections using a specially crafted HTML page, allowing cross-site data access that should be restricted. The attack requires prior compromise of the renderer process but does not require user interaction beyond visiting the malicious page. The vulnerability was fixed in Chrome 153.0.8010.36 released on September 8, 2026. Chrome rates the underlying Chromium issue as medium severity, though the NVD severity is assessed as high with a CVSS v3.1 score of 8.1.
Affected products
- Google Chrome prior to 153.0.8010.36
Timeline
- 2026-09-09: disclosed
- 2026-09-08: patched