Executive brief
A security vulnerability in Google Chrome's Site Isolation feature could allow a remote attacker to bypass security boundaries. Site Isolation is a critical defense-in-depth mechanism that keeps data from different websites separate to prevent malicious sites from stealing information. If exploited, an attacker who has already partially compromised the browser's rendering process could access sensitive data from other open websites or user sessions.
Technical details
An improper input validation vulnerability (CWE-20) exists in the Site Isolation component of Google Chrome. The flaw allows a remote attacker who has already achieved code execution within a compromised renderer process to bypass the Site Isolation boundary. This is achieved by leveraging a specially crafted MHTML (MIME HTML) page to trick the browser into mismanaging cross-site data boundaries. Successful exploitation allows the attacker to access data from other origins that should be isolated. The issue is resolved in Chrome version 148.0.7778.216 and later.
Affected products
- Google Chrome Prior to 148.0.7778.216
Timeline
- 2026-05-27: patched: Stable channel update released for desktop
- 2026-05-28: disclosed: CVE published to NVD dataset