CVE-2026-15130: Chrome Site Isolation Bypass – Patching Guidance

Technical summary

The vulnerability stems from insufficient policy enforcement within Chrome's Navigation component. Site isolation, introduced to prevent cross-site data theft, relies on strict enforcement of navigation policies to maintain process boundaries between sites. This flaw allows a remote attacker to circumvent those protections through a specially crafted HTML page, without requiring elevated privileges or complex user interaction beyond visiting a malicious URL. The Chromium security team classified this as High severity in their internal assessment, reflecting the potential for cross-site information disclosure.

Business impact

Site isolation bypass creates direct exposure to credential theft and sensitive data exfiltration. For organizations where employees access high-value web applications (SaaS platforms, internal portals, financial systems), a compromised browsing session could lead to unauthorized access to business-critical information. The attack requires user interaction but no special network positioning, making it a feasible vector against targeted users or broad phishing campaigns. Data loss, compliance violations, and remediation costs are the primary business concerns.

Affected systems

Google Chrome browser installations prior to version 150.0.7871.115 are vulnerable. This includes all Chrome variants (stable, extended) on Windows, macOS, Linux, iOS, and Android running older builds. Organizations relying on Chrome as a standard browser, particularly in security-sensitive roles, should prioritize inventory and patching. ChromeOS devices also run the Chrome engine and require corresponding security updates.

Exploitability

Exploitability is straightforward: an attacker needs only to craft an HTML page and deliver it to a user, typically via email, social engineering, or malicious advertising. No user technical sophistication is required beyond following a link. The attack surface is wide because the flaw exists in core navigation logic. However, the vulnerability requires active user engagement (visiting the malicious page) rather than being triggered passively. There is no evidence this flaw is currently leveraged in widespread attacks, as it is not listed in the CISA Known Exploited Vulnerabilities catalog.

Remediation

Update Google Chrome to version 150.0.7871.115 or later. Users should enable automatic updates if not already configured. Organizations should verify deployment through Chrome management policies and mobile device management solutions. For enterprise deployments, validate update completion via policy reporting before considering remediation complete. No workarounds are available; patching is the only mitigation.

Patch guidance

Chrome auto-updates are typically delivered within days of release. Verify your installed version at chrome://version/. Enterprise administrators should deploy via Chrome Enterprise update channels, confirming version 150.0.7871.115 or newer across all managed devices. Organizations using managed Chrome policies can enforce minimum version requirements to prevent use of vulnerable builds. On Android and iOS, updates are delivered through the respective app stores; ensure your organization's mobile device management system permits or enforces timely app updates.

Detection guidance

Monitor Chrome version distributions in your environment to identify stragglers on pre-150.0.7871.115 builds. Network-based detection is unlikely to be reliable without behavioral context; focus on asset inventory and version enumeration. Endpoint Detection and Response tools with browser telemetry can flag outdated Chrome instances. For incident response, examine browser history and cache for unexpected cross-site navigation patterns or signs of credential compromise following suspicious browsing activity. Log authentication systems for anomalous login sources or timing around the vulnerability publication date.

Why prioritize this

Although the CVSS score is moderate (4.3), the practical impact of site isolation bypass justifies urgent attention. Site isolation is a foundational Chrome security feature; its circumvention directly enables credential and data theft. The wide attack surface (any HTML page), low barrier to user interaction, and potential for targeted attacks against high-value users make this a priority above its CVSS rating. Organizations with sensitive web application usage should patch within days, not weeks. The absence from the KEV list does not lower priority; it reflects current threat intelligence, not the absence of risk.

Risk score, explained

The CVSS 3.1 score of 4.3 (MEDIUM) reflects low attack complexity, no privilege requirement, and user interaction needed, but limited scope (single user's confidentiality). The score underrepresents the security boundary violation because CVSS does not fully weight the loss of site isolation as a defense-in-depth layer. Real-world impact depends on what the targeted user accesses; compromise of a user with high-privilege SaaS accounts or access to sensitive portals elevates risk considerably. Recommend contextual risk scoring based on user roles and accessed applications.

Frequently asked questions