CVE-2026-76033
Description
A flaw was found in Google Chrome's handling of Cross-Origin Resource Sharing (CORS). A remote attacker, who has already compromised the browser's renderer process, could exploit this vulnerability by using a specially crafted HTML page. This could allow the attacker to bypass site isolation, a security feature designed to prevent malicious websites from accessing data from other websites, potentially leading to unauthorized data access.
Statement
This Important flaw in chromium-browser allows a remote attacker to bypass site isolation after an initial compromise of the browser's renderer process. This could lead to unauthorized access to sensitive data from other websites, significantly undermining a core browser security boundary.
Understanding the Weakness (CWE)
Access Control
Technical Impact: Gain Privileges or Assume Identity; Bypass Protection Mechanism
The exploitation of a weakness in low-privileged areas of the software can be leveraged to reach higher-privileged areas without having to overcome any additional obstacles.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
