CVE-2026-12032: Chrome Android Site Isolation Bypass via Password Handling Flaw

Technical summary

CVE-2026-12032 is an inappropriate implementation vulnerability in Chrome's password handling mechanisms on Android. The vulnerability resides in the interaction between password management features and site isolation enforcement. An attacker who has already achieved renderer process compromise (via a separate vulnerability) can craft a malicious HTML page that circumvents site isolation boundaries, potentially allowing access to sensitive data from other origins. The vulnerability is classified under CWE-346 (Origin Validation Error), indicating the issue stems from improper validation of page origins when enforcing cross-origin protections. Chromium's assessment rated this as High severity from a browser architecture perspective, though the CVSS 3.1 score of 3.1 reflects the requirement for pre-existing renderer compromise.

Business impact

The real-world impact depends on whether a renderer compromise vulnerability is actively circulating or has been weaponized alongside this flaw. For organizations deploying Chrome on managed Android devices, this presents a secondary-stage attack risk: users already targeted by advanced attackers exploiting remote code execution in Chrome could face additional exposure if sensitive data from multiple websites is accessible within a compromised process. For enterprise users managing sensitive financial, health, or authentication workflows across multiple tabs or windows, a site isolation bypass could amplify data exfiltration in targeted attacks. However, the attack chain remains complex and not opportunistic.

Affected systems

Google Chrome on Android versions prior to version 149.0.7827.115 are affected. This includes all earlier 149.x versions and all previous major versions on Android platforms. Desktop Chrome versions (Windows, macOS, Linux) are not affected by this Android-specific implementation issue. The vulnerability is specific to how Android's platform constraints and Chrome's password handling subsystem interact, making it platform-specific rather than cross-platform.

Exploitability

Practical exploitation requires multiple conditions: first, an attacker must compromise the Chrome renderer process through a separate vulnerability (no single-click or simple web-based path exists), and second, the victim must then visit a malicious website under the attacker's control. This makes opportunistic, mass-scale exploitation unlikely. However, targeted attack scenarios—where an advanced threat actor chains multiple vulnerabilities to compromise a high-value target's device and then exfiltrate cross-site data—remain plausible. The requirement for prior renderer compromise significantly restricts the attack surface compared to standalone vulnerabilities.

Remediation

Update Google Chrome on Android to version 149.0.7827.115 or later. Users should enable automatic updates in Chrome settings to receive patches immediately upon release. For organizations managing Android devices via MDM solutions, deploy the updated Chrome version through your device management console. No workarounds exist that provide equivalent protection to the patch; the vulnerability requires a code-level fix in Chrome's password and site isolation implementation.

Patch guidance

Verify that Chrome on Android has been updated to version 149.0.7827.115 or later by opening Chrome Settings > About Chrome, which will display the current version and automatically check for updates. For enterprise deployments, use your organization's Android MDM solution (such as Google Workspace, Intune, or MobileIron) to enforce the minimum version requirement. Test the patch in a non-production environment if your organization uses Chrome extensions or custom authentication flows tied to password management, though this vulnerability itself does not introduce new compatibility risks.

Detection guidance

Direct detection of exploitation attempts is difficult without access to Chrome's internal renderer process logs. Organizations should focus on behavioral detection: monitor for unusual data exfiltration following device compromise (via EDR, network DLP, or cloud access logs), and track Chrome version compliance across Android inventory using MDM reporting. If a renderer-process-level vulnerability is discovered in the wild, prioritize threat hunting for devices still running Chrome versions below 149.0.7827.115, as they would be vulnerable to this site isolation bypass if chained with the renderer exploit.

Why prioritize this

Despite the LOW CVSS score, this vulnerability deserves attention because it represents a site isolation bypass—a high-impact capability in multi-stage attacks. Prioritize patching in environments where: (1) users access sensitive multi-site workflows on Android Chrome (banking, healthcare, SaaS management), (2) your organization faces targeted threats or operates in high-risk sectors, and (3) you have limited visibility into renderer-level compromises. For organizations with general consumer-facing user bases and no specific targeting indicators, this can follow routine patch cycles, but should not be deprioritized indefinitely.

Risk score, explained

The CVSS 3.1 score of 3.1 (LOW) reflects the requirement for prior renderer process compromise and user interaction (visiting a malicious page). However, the Chromium security team's assessment of HIGH severity for browser architecture underscores that a successful site isolation bypass is a high-impact primitive. The disconnect between CVSS and Chromium severity highlights that CVSS alone does not capture the exploit chain context; the true risk depends on whether renderer compromise vulnerabilities are prevalent or actively exploited in your threat model.

Frequently asked questions