CVE-2026-12017: Chrome Site Isolation Bypass via Extension Flaw (149.0.7827.115)

Technical summary

CVE-2026-12017 stems from an improper input validation issue (CWE-20) in Chrome's extension implementation. Site isolation is a foundational Chrome security mechanism that runs each site in its own process to prevent cross-site data theft. This vulnerability allows a threat actor who has already gained renderer process execution—via prior browser exploit or malware—to craft a malicious HTML page that triggers a logic flaw in extension handling, bypassing site isolation boundaries. The renderer context can then access memory and resources it should not be able to reach, potentially exposing sensitive data from other origins.

Business impact

For most organizations, the real-world risk is constrained by the prerequisite: an attacker must first compromise Chrome's renderer process through another vulnerability or infection vector. If that precondition exists, this flaw could enable data exfiltration from multiple websites within a single browser session without the user's knowledge. This is most relevant to high-value targets (financial services, defense, research) where sophisticated multi-stage attacks are plausible. General enterprise risk is low unless users are already exposed to renderer-level exploits.

Affected systems

The vulnerability affects Google Chrome prior to version 149.0.7827.115 on Windows, macOS, and Linux systems. The listing also references Linux kernel and Windows as affected platforms, indicating that Chrome's dependency chain may expose these OS-level components; however, the primary affected application is Chrome itself. Organizations running any Chrome version older than 149.0.7827.115 should prioritize patching.

Exploitability

Exploitation requires two prerequisites: (1) the attacker must first compromise the Chrome renderer process via a separate vulnerability or infection, and (2) the user must visit a crafted webpage while running the vulnerable browser. This two-stage requirement significantly reduces exploitability compared to direct renderer flaws. The CVSS 3.1 score of 3.1 (LOW) reflects these constraints—high attack complexity and the need for user interaction. No public exploits are tracked in CISA's KEV catalog, and there is no evidence of active exploitation in the wild.

Remediation

Update Google Chrome to version 149.0.7827.115 or later. Chrome's auto-update mechanism typically delivers patches within days of release; verify that auto-update is enabled in your environment. For managed deployments, push the update through your desktop management or mobile device management tools. No workarounds exist; patching is the only remediation. Users on Windows, macOS, and Linux should all apply this update.

Patch guidance

Install Chrome version 149.0.7827.115 or newer. On Windows and macOS, Chrome auto-updates in the background; users can accelerate patching by restarting the browser. On Linux, the mechanism varies by distribution; Ubuntu and Debian users should run 'apt upgrade google-chrome-stable' (or equivalent for their package manager), and others should verify their distro's Chrome package status. Enterprise administrators can leverage Chrome's managed update settings or force immediate rollout via GPO/MDM. Test the update on a pilot system before widespread deployment if required by your change management process.

Detection guidance

Monitor browser version compliance through endpoint detection and response (EDR) solutions or mobile device management tools that track installed Chrome versions. Flag any machines running Chrome versions prior to 149.0.7827.115. Check browser logs for failed extension operations or unexpected extension behavior, though direct detection of exploitation is difficult without forensic analysis. Monitor network traffic for anomalous data exfiltration patterns that might indicate a compromised renderer escaping site isolation. Organizations using Chrome Enterprise can review the Chrome Management Console to identify non-compliant devices.

Why prioritize this

Although the CVSS score is LOW, this vulnerability should not be dismissed entirely. The prerequisite renderer compromise limits immediate risk, but if your organization has been targeted by advanced attackers or has reason to suspect renderer-level exploitation, patching this flaw quickly prevents a follow-on attack vector. General enterprises with no evidence of targeted attacks may address this in their standard patch cycle but should not delay by weeks. The combination of high Chromium severity classification and the two-stage attack path warrants prompt but measured response.

Risk score, explained

The CVSS 3.1 score of 3.1 (LOW) reflects: Network-based attack vector (AV:N), but high attack complexity (AC:H) due to the need to first compromise the renderer; No privileges required (PR:N) once renderer is compromised; User interaction required (UI:R) to visit the malicious page; Confidentiality impact limited (C:L) to data accessible from the current browser context; No integrity or availability impact (I:N, A:N). The low score appropriately captures that exploitation requires a prior compromise. However, the Chromium severity is rated HIGH, signifying that once a renderer is compromised, this flaw becomes a significant secondary threat. Practitioners should weigh both metrics when prioritizing.

Frequently asked questions