CVE-2026-12453: Chrome Same-Origin Policy Bypass in Renderer Process

Technical summary

The vulnerability stems from inadequate validation of untrusted input in Chrome's renderer process. It falls under CWE-20 (Improper Input Validation). An attacker with renderer-process-level compromise can craft HTML that bypasses same-origin policy protections, potentially leading to unauthorized cross-origin data access or manipulation. The Chromium security team rated this as High severity. The CVSS 3.1 score of 4.2 (Medium) reflects that while the confidentiality and integrity impacts are present, the attack requires both network access and user interaction, plus prior renderer compromise—a multi-stage attack chain.

Business impact

Same-origin policy violations expose users to credential theft, session hijacking, and data exfiltration from authenticated web sessions. If an attacker chains this with a separate renderer-process vulnerability, they could potentially extract sensitive information from banking portals, SaaS applications, or internal web tools. The blast radius is limited by the requirement to first compromise the renderer, but organizations with high-value web applications should treat this as part of a broader attack surface assessment.

Affected systems

Chrome on Windows, macOS, and Linux systems running versions prior to 149.0.7827.155 are affected. Users on the Stable, Extended Stable, and Beta channels should prioritize updates. The vulnerability affects the browser itself rather than the underlying operating systems, though all major OS variants that support Chrome are in scope.

Exploitability

Exploitation requires two preconditions: first, compromise of the Chrome renderer process (via a separate vulnerability or sandboxbreak), and second, user interaction with a crafted HTML page. The attack is not wormable and cannot be triggered passively. The moderate CVSS score correctly reflects that while the technical impact is meaningful, the exploitation barrier is substantial. This is not currently tracked in CISA's Known Exploited Vulnerabilities catalog.

Remediation

Update Google Chrome to version 149.0.7827.155 or later. Organizations should deploy this update through their standard patch management process, prioritizing user-facing systems and any machines that regularly access high-value web applications. Concurrent browser hardening—such as disabling unnecessary extensions or leveraging enterprise policies that restrict renderer-process-level access—can provide additional defense in depth.

Patch guidance

Chrome updates are typically automatic for consumer users but may require manual deployment in enterprise environments. Verify the installed version via Chrome's About page (chrome://about), which will auto-update if a newer version is available. Enterprise administrators should consult Google's Chrome Enterprise support documentation to push version 149.0.7827.155 or later via group policy, mobile device management, or cloud console. No interim mitigations are publicly documented; patching is the primary remediation.

Detection guidance

Monitor for Chrome process crashes or unexpected renderer terminations, which may indicate exploitation attempts. If feasible, use browser telemetry or endpoint detection platforms to track Chrome version compliance across your environment. Look for suspicious cross-origin network requests originating from web applications that should be isolated. Security teams with access to Chrome enterprise logs should review for renderer process anomalies or policy violations around the time patches are deployed.

Why prioritize this

Although the CVSS score is 4.2 (Medium), this vulnerability warrants timely patching because it directly undermines web isolation guarantees that many organizations rely on. The flaw becomes dangerous when chained with other renderer vulnerabilities, making it a component of a potential high-impact attack. Prioritize systems accessed by employees dealing with sensitive web applications (finance, healthcare, legal). However, this is not a critical emergency—organizations should integrate it into their standard monthly patch cycle.

Risk score, explained

The CVSS 3.1 score of 4.2 reflects a Network-based attack with High complexity, no privilege requirement, and user interaction needed. The scope is Unchanged, with Low confidentiality and Low integrity impact, and no availability impact. This is conservative because it does not account for the renderer-compromise prerequisite; in isolation, the same-origin bypass alone would be higher severity. The score appropriately penalizes the complexity of the multi-stage attack, but defenders should recognize that chaining this with other renderer flaws would significantly elevate real-world risk.

Frequently asked questions