CVE-2026-102330: Incorrect Authorization in Chrome Site Isolation Allows Web Origin Policy Bypass · ZeroHour

CVE-2026-102330

mass

Incorrect Authorization in Chrome Site Isolation Allows Web Origin Policy Bypass

CVSS 3.1

6.5 medium

EPSS

—

Published

Sep 29, 2026 (1d ago)

Modified

Sep 30, 2026

AI analysis

Google Chrome versions prior to 154.0.8037.92 contain an incorrect authorization flaw (CWE-863) in the Site Isolation component, which is Chrome's defense that keeps cross-origin sites in separate renderer processes. A remote attacker who has already compromised a renderer process can exploit this via a crafted HTML page to bypass the web origin policy, potentially enabling access to data or content that should be isolated to a different origin. Because exploitation requires the attacker to first gain code execution in the renderer (for example through a separate renderer bug), this is a defense-in-depth weakening issue rather than a standalone entry point, which is why Google rates it Low severity. All users running Chrome older than 154.0.8037.92 are affected; the flaw was fixed in the Chrome 154 stable channel update that resolved 32 security issues. There is no public proof of concept, it is not on the CISA KEV list, and no exploitation has been reported.

What to do: Update Chrome to 154.0.8037.92 or later immediately (Help > About Chrome triggers the update; verify auto-updates are enabled). Enterprise admins should audit fleet browser versions and force updates for any devices on older builds. Because this bug requires a prior renderer compromise, also prioritize rapid patching of renderer-layer Chrome vulnerabilities to break potential exploit chains.

Affected

Google Chrome

< 154.0.8037.92

Estimated exposure

mass≈3 billion users (Chrome's global installed base, order of magnitude) — Chrome holds roughly 60–65% of the global browser market across desktop and mobile, and Google has publicly cited more than 3 billion Chrome users, so virtually the entire pre-154 install base was exposed until the update.

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description

Incorrect authorization in SiteIsolation in Google Chrome prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)

Vendors: google
Products: chrome
Weakness: CWE-863
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

NVD CVE.org GitHub PoCs EPSS (—)

CVE-2026-102330

In the news1 stories

Google Chrome 154 Update Fixes 32 Security Flaws Including Critical ANGLE Bug