CVE-2026-76033 in Chrome
Summary
by MITRE • 08/19/2026
Inappropriate implementation in CORS in Google Chrome prior to 151.0.7922.169 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: High)
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/21/2026
The vulnerability described involves an inappropriate implementation of Cross-Origin Resource Sharing policies within Google Chrome prior to version 151.0.7922.169, which fundamentally undermines the browser's site isolation mechanisms. Site isolation is a critical security feature designed to prevent cross-site scripting and data theft by ensuring that different origins are rendered in separate processes with isolated memory spaces. When this mechanism fails due to flawed CORS handling, it creates a pathway for remote attackers who have already compromised the renderer process of one tab or frame to access sensitive data from other tabs or frames belonging to different origins. This bypass allows an attacker to read cookies, local storage, and DOM content that should remain strictly isolated under normal security boundaries.
From a technical perspective, this flaw represents a failure in enforcing strict origin checks during resource fetch operations governed by CORS headers. The renderer process is responsible for executing web page code, including JavaScript, which can make network requests. If the browser incorrectly interprets or applies CORS policies when these requests are made across different origins within isolated contexts, it may grant access to resources that should be blocked. This misconfiguration effectively collapses the security boundary between distinct sites, allowing a malicious script running in one context to exfiltrate data from another context where sensitive user information resides. The severity is classified as high because renderer process compromise is often achievable through drive-by downloads or exploiting other lower-severity vulnerabilities such as cross-site scripting flaws.
The operational impact of this vulnerability is significant for users browsing the web, particularly those who engage in activities involving sensitive personal data on multiple sites simultaneously. An attacker leveraging this flaw could perform unauthorized actions on behalf of the user, steal session tokens to hijack accounts, or gather confidential information stored locally by web applications. This directly contradicts the principle of least privilege and isolation that modern browsers strive to maintain. The ability to bypass site isolation means that even if a user has no other active vulnerabilities exploited in their current browsing session, the mere presence of this flaw in older browser versions leaves them exposed to sophisticated attacks that rely on cross-origin data leakage.
To mitigate this risk, users must ensure they are running Google Chrome version 151.0.7922.169 or later, where these CORS implementation issues have been addressed by the Chromium security team. System administrators should enforce automatic updates for all endpoints to prevent exposure to known browser vulnerabilities. For developers and security analysts, this incident highlights the importance of maintaining up-to-date software dependencies and monitoring vendor advisories closely. The vulnerability aligns with CWE-200, which covers information exposure through misconfigured access controls, and can be mapped to ATT&CK technique T1530, involving data from cloud or storage objects via unauthorized API calls when browser isolation fails. Regular patching remains the most effective defense against such implementation flaws in web rendering engines.