Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-08-18T20:31:25 chromium-browser: Google Chrome: Site isolation bypass due to inappropriate CORS implementation 8.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N CWE-653

Inappropriate implementation in CORS in Google Chrome prior to 151.0.7922.169 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: High)

A flaw was found in Google Chrome's handling of Cross-Origin Resource Sharing (CORS). A remote attacker, who has already compromised the browser's renderer process, could exploit this vulnerability by using a specially crafted HTML page. This could allow the attacker to bypass site isolation, a security feature designed to prevent malicious websites from accessing data from other websites, potentially leading to unauthorized data access.

This Important flaw in chromium-browser allows a remote attacker to bypass site isolation after an initial compromise of the browser's renderer process. This could lead to unauthorized access to sensitive data from other websites, significantly undermining a core browser security boundary. https://www.cve.org/CVERecord?id=CVE-2026-76033 https://nvd.nist.gov/vuln/detail/CVE-2026-76033 https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0826575033.html https://issues.chromium.org/issues/516715010