CVE-2026-79002 in Chrome
Summary
by MITRE • 08/25/2026
Incorrect authorization in SiteIsolation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/25/2026
The vulnerability identified as an incorrect authorization flaw within the SiteIsolation component of Google Chrome prior to version 152.0.7977.65 represents a significant breach in browser-based isolation mechanisms. Site Isolation is a critical security feature designed to prevent cross-site scripting attacks and data theft by ensuring that each site runs in its own process, thereby isolating sensitive data from other sites. This specific flaw allows a remote attacker who has already compromised the renderer process of one tab or frame to bypass these isolation boundaries through the execution of a crafted HTML page. The severity is classified as medium within the Chromium security framework, indicating that while exploitation requires prior compromise of a renderer process, the resulting impact on confidentiality and integrity is substantial due to the potential for cross-origin data access.
From a technical perspective, this vulnerability stems from an authorization logic error where the browser fails to properly validate whether a specific operation or data request should be permitted across site boundaries after a renderer has been compromised. In normal operations, Site Isolation ensures that even if malicious code executes within one origin's context, it cannot access cookies, local storage, or DOM elements belonging to another origin because they reside in separate processes with strict inter-process communication controls. However, the flaw allows an attacker leveraging a crafted HTML page to exploit this gap, effectively tricking the browser into granting elevated privileges or data access that should have been denied based on the originating site's identity. This bypass undermines the fundamental assumption of process isolation that underpins modern web security models.
The operational impact of this vulnerability is severe for users who visit maliciously crafted websites while running an affected version of Chrome. An attacker could potentially exfiltrate sensitive user data such as session tokens, authentication cookies, or personally identifiable information stored in local storage from other open tabs or frames that belong to different origins. This capability facilitates sophisticated phishing campaigns and account takeover attacks where the initial foothold might be gained through a less severe vulnerability like cross-site scripting, which then escalates into full site isolation bypass. The ability to read data across sites means that even if an attacker cannot directly inject scripts into a target bank or email service page due to Same-Origin Policy protections, they can still access sensitive information from other compromised contexts within the same browser session, leading to widespread privacy violations and potential financial loss for end-users.
This issue aligns with CWE-269, which describes Improper Authorization, as it involves a failure in the system's ability to enforce proper permissions during resource access operations. Furthermore, it relates to ATT&CK technique T1057, specifically Process Discovery or potentially T1048 if used for exfiltration over alternative channels, though primarily it facilitates lateral movement within the browser environment by breaking trust boundaries between origins. Mitigation strategies are straightforward and rely on timely software updates. Users must upgrade Google Chrome to version 152.0.7977.65 or later where these authorization checks have been corrected to ensure that renderer processes cannot exploit gaps in site isolation logic. Additionally, organizations should enforce strict content security policies and consider using browser hardening extensions that limit the capabilities of embedded scripts and frames, providing an additional layer of defense against exploitation attempts even if a vulnerability is present. Regular patch management remains the most effective control against such zero-day or recently disclosed vulnerabilities in widely used web browsers.