CVE-2026-15131: Chrome Site Isolation Bypass via Navigation Flaw

Technical summary

CVE-2026-15131 stems from an inappropriate implementation in Chrome's Navigation component that fails to properly enforce site isolation boundaries. Site isolation is Chrome's architecture for keeping different website origins in separate processes. The vulnerability allows a crafted HTML page, when visited by a user, to circumvent these isolation mechanisms. The attack vector is network-based with low attack complexity, requiring only user interaction (clicking a link or visiting a page). The resulting impact is limited to confidentiality loss—an attacker may read data from pages in other origins—with no integrity or availability impact. This is classified as CWE-20 (Improper Input Validation).

Business impact

Site isolation bypass represents a breach of browser-level trust assumptions that security teams rely on. While the direct impact is limited to information disclosure from the user's current session, successful exploitation could expose sensitive data accessed during that session—login credentials, personal information, or proprietary data. For enterprises, this means users could inadvertently leak session data if tricked into visiting a malicious site. The low severity score reflects the requirement for user interaction and the contained scope of exposure, but the nature of the vulnerability (touching a foundational security model) warrants timely patching.

Affected systems

Google Chrome prior to version 150.0.7871.115 is affected across all platforms where Chrome runs (Windows, macOS, Linux, Android, and iOS). Any user running an unpatched version of Chrome in this range is potentially exposed if they visit a crafted malicious page. Chromebook users running vulnerable Chrome versions are also affected.

Exploitability

Exploitation requires a remote attacker to host or inject a crafted HTML page and convince a user to visit it. The attack has low complexity and requires no special privileges on the target system. However, user interaction is mandatory—the victim must navigate to the malicious page. There is no indication this vulnerability has been exploited in the wild or that public exploit code exists. The requirement for user-directed interaction and the need for the victim to have the target origin's data open concurrently moderately constrains real-world exploitation, though the attack surface (the web itself) remains broad.

Remediation

Update Google Chrome to version 150.0.7871.115 or later. Chrome's auto-update mechanism will deploy the patch automatically for most users, but verification is recommended, particularly in managed environments. Organizations should verify deployment via Chrome's version reporting (chrome://version) or through endpoint management tools. No workarounds exist; patching is the only mitigation.

Patch guidance

Organizations should prioritize deployment of Chrome 150.0.7871.115 or later within 1–2 weeks, following standard patch management cycles. For Chromebook fleets, ensure auto-update is enabled or manually push the update via your device management console. Test patch deployment in a small group first if you use custom Chrome policies. Verify successful updates via chrome://version on end-user devices. No breaking changes or configuration adjustments are expected with this patch.

Detection guidance

Detection of exploitation attempts is challenging at the network level, as the attack involves a standard HTML page visit. Monitor for unusual site isolation-related crashes in Chrome error reports (chrome://crashes) as a potential indicator. Endpoint detection and response (EDR) tools may flag browser process anomalies if an attacker attempts to read cross-origin memory. Log Chrome's update status to confirm patching compliance. Network monitoring for visits to known malicious HTML pages serves as a secondary indicator.

Why prioritize this

While the CVSS score is Medium (4.3) and the impact is limited to confidentiality, the vulnerability touches Chrome's core security architecture. Organizations should prioritize this patch because (1) site isolation is a critical defense-in-depth control, (2) the attack is user-directed and somewhat hard for end-users to recognize, (3) no active exploitation is currently known, allowing time for orderly patching, and (4) the patch is low-risk and widely compatible. Schedule it in your next routine patch cycle, not as an emergency.

Risk score, explained

The CVSS 3.1 score of 4.3 reflects a Network-based, Low Complexity attack requiring User Interaction, with Unchanged Scope and Low Confidentiality impact. The score appropriately captures that an attacker cannot directly initiate the breach—user action is essential—and the harm is limited to reading data an attacker could not previously access. Integrity and availability are unaffected. The Medium severity rating aligns with the browser vendor's assessment.

Frequently asked questions