Description

Inappropriate implementation in CORS in Google Chrome prior to 151.0.7922.169 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: High)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.2",
  "pubDate": "2026-08-18T21:18:27.263Z",
  "pubdate": "2026-08-18T21:18:27.263Z",
  "executiveSummary": "An inappropriate implementation vulnerability exists within the Cross-Origin Resource Sharing (CORS) mechanism of Google Chrome prior to version 151.0.7922.169. This flaw allows a remote attacker who has already compromised the renderer process to successfully bypass site isolation enforcement mechanisms via a crafted HTML page. The security severity of this vulnerability is classified as High by Chromium security standards.\nThe primary impact of this vulnerability is the circumvention of site isolation security boundaries, potentially exposing sensitive cross-origin data and undermining the sandboxing architecture designed to isolate web contexts. Successful exploitation requires the attacker to have pre-existing compromise of the renderer process, which then facilitates further exploitation through maliciously constructed HTML payloads. Risk implications include the degradation of multi-process security guarantees within the browser engine, potentially leading to unauthorized data access across origin boundaries.\nAffected systems include Google Chrome installations running versions prior to 151.0.7922.169. Mitigation requires updating the browser to the patched version provided by the vendor.",
  "technicalDetails": "The vulnerability resides in the Cross-Origin Resource Sharing (CORS) implementation within Google Chrome prior to version 151.0.7922.169, specifically impacting the components responsible for enforcing site isolation and cross-origin security boundaries. The root cause stems from improper validation or flawed logic in handling CORS checks when interacting with the renderer process.\nExploitation of this vulnerability requires an attacker to first achieve code execution or compromise within the renderer process. Once the renderer process is compromised, the attacker can leverage a crafted HTML page designed to interact with the vulnerable CORS implementation. Due to the inappropriate implementation of CORS checks, the crafted HTML page manipulates browser behavior to bypass site isolation enforcement.\nThe attack flow proceeds as follows: First, the attacker compromises the renderer process through a separate vulnerability or injection vector. Second, the attacker loads or directs the compromised context to render a specially crafted HTML page. Third, the crafted page initiates cross-origin requests or operations that trigger the flawed CORS handling logic. Fourth, the browser fails to properly enforce site isolation constraints due to the improper implementation, allowing the attacker to bypass isolation boundaries and access restricted cross-origin resources or data.\nThe vulnerable component is the CORS handling mechanism interacting with site isolation controls in the Chromium engine. The affected software versions encompass all Google Chrome builds preceding 151.0.7922.169. Authentication and privilege requirements include a pre-compromised renderer process, operating within the standard browser sandbox architecture prior to privilege escalation or boundary traversal. Network exposure is local to the browser execution context via the crafted HTML page processed by the engine."
}