site isolation

CVE-2026-13866 affects Google Chrome on Android before 150.0.7871.47. A remote attacker who has already compromised Chrome’s renderer could use crafted HTML to bypass Site Isolation. Update Chrome to 150.0.7871.47 or later. The renderer-compromise prerequisite changes how the issue should be...

Google disclosed CVE-2026-13919 on June 30, 2026, as a medium-severity Chrome Extensions flaw fixed before version 150.0.7871.47, where a renderer-compromise attacker could use a crafted HTML page to bypass site isolation. The terse description, now reflected in the National Vulnerability...

CVE-2026-13034 is a high-severity Google Chrome vulnerability disclosed on June 24, 2026, affecting Chrome versions before 149.0.7827.197, where an attacker who had already compromised the renderer process could use a crafted HTML page to bypass site isolation. The short version is simple: this...

Google Chrome before 149.0.7827.197 contained CVE-2026-13024, a high-severity Chromium navigation flaw disclosed on June 24, 2026, that could let an attacker who had already compromised Chrome’s renderer process bypass site isolation with a crafted HTML page. That narrow precondition is the...

CVE-2026-11693 is a high-severity Google Chrome vulnerability, published by NVD on June 8, 2026 and fixed in Chrome 149.0.7827.103, that allowed a renderer-compromise attacker to bypass Site Isolation through a crafted HTML page on desktop platforms. The short version for WindowsForum readers is...

Google Chrome prior to 149.0.7827.103 contains CVE-2026-11689, a high-severity Passwords component flaw published June 8, 2026, in which a remote attacker who already compromised the renderer could use a crafted HTML page to bypass site isolation on desktop platforms. The short version is that...

Google disclosed CVE-2026-11668 on June 8, 2026, as a high-severity Chromium codecs flaw affecting Google Chrome on Linux and ChromeOS before version 149.0.7827.103, where a crafted video file could let a remote attacker leak cross-origin data. The bug is not the loudest item in the June Chrome...

Google Chrome’s CVE-2026-11658, published June 8, 2026 and last modified by NVD on June 10, describes an Extensions input-validation flaw in Chrome before 149.0.7827.103 that could let an attacker with a compromised renderer bypass site isolation using a crafted HTML page. The bug is not the...

Google disclosed CVE-2026-7909 on May 6, 2026, as a high-severity Chromium flaw in ServiceWorker handling that affects Chrome before 148.0.7778.96 and could let an attacker who already compromised the renderer bypass site isolation with a crafted HTML page. That phrasing sounds narrow, almost...

Google and Microsoft disclosed CVE-2026-7945 on May 6, 2026, describing a medium-severity Chromium flaw in Cross-Origin-Opener-Policy handling that affected Chrome before 148.0.7778.96 and could let an attacker who already compromised the renderer bypass site isolation with crafted HTML. That...

Google and Microsoft documented CVE-2026-7966 on May 6–7, 2026, as a Chromium SiteIsolation input-validation flaw fixed in Chrome 148.0.7778.96 and Microsoft Edge 148.0.7778.xxx, allowing a renderer-compromising attacker to bypass site isolation with a crafted HTML page. The important part is...

Google and Microsoft disclosed CVE-2026-7971 on May 6, 2026, after Chrome 148.0.7778.96/97 began rolling out for Windows, macOS, and Linux, fixing a medium-severity Chromium flaw in Opaque Response Blocking that could let a crafted HTML page bypass Site Isolation. The bug is not the loudest item...

CVE-2026-7360 is a high-severity Chromium compositing flaw fixed in Google Chrome 147.0.7727.137/138 on April 28, 2026, affecting desktop Chrome before 147.0.7727.138 and allowing an attacker who already compromised the renderer process to bypass site isolation using a crafted HTML page. The...

Chromium developers have closed a high‑severity upstream bug — tracked as CVE‑2025‑10201 — that the Chromium project describes as an “inappropriate implementation in Mojo” which could be abused, via a crafted HTML page, to bypass Chrome’s site‑isolation protections on Android, Linux and...