CVE-2026-76033: High Inappropriate implementation in CORS
Chromium: CVE-2026-76033 Inappropriate implementation in CORS
Other sources
Inappropriate implementation in CORS in Google Chrome prior to 151.0.7922.169 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: High)
— MITRE
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 151.0.4129.101 - Upgrade
Upgrade
Chromium / Google Chrome (renderer -> CORS site isolation bypass)to a version that resolves this vulnerability.Fixed in 151.0.7922.169 - Compensating control
For Microsoft Edge (Chromium-based), ensure you are running a version that includes the upstream Chromium fix for CVE-2026-76033 (Chrome prior to 151.0.7922.169 is affected).
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
- CVE-2026-12462
- CVE-2026-12025
- CVE-2026-76018
- CVE-2026-12016
- CVE-2026-76023
- CVE-2026-11701
- CVE-2026-11664
- CVE-2026-76022
- CVE-2026-76045
- CVE-2026-19558
- CVE-2026-13027
- CVE-2026-17693
- CVE-2026-15777
- CVE-2026-19144
- CVE-2026-11666
- CVE-2026-10949
- CVE-2026-11658
- CVE-2026-11652
- CVE-2026-19559
- CVE-2026-10938
- CVE-2026-9124
- CVE-2026-9951
- CVE-2026-7991
- CVE-2026-11681
- CVE-2026-19145
- CVE-2026-13034
- CVE-2026-19165
Frequently Asked Questions
What does an attacker need before they can exploit this issue?
Exploitation requires the attacker to have already compromised the Chrome renderer process and to use a crafted HTML page. The issue is therefore most relevant in scenarios where a renderer compromise is possible or has already occurred.
Which Chrome versions are affected?
The vulnerable condition affects Google Chrome versions prior to 151.0.7922.169. Updating Chrome to 151.0.7922.169 or later addresses the affected version range.
What is the security impact of successful exploitation?
A successful exploit can bypass Chrome site isolation after the renderer process has been compromised. This could weaken the separation that site isolation is intended to provide between sites.