CVE-2026-76033: Input Validation

Q: What does an attacker need before they can exploit this issue?

Exploitation requires the attacker to have already compromised the Chrome renderer process and to use a crafted HTML page. The issue is therefore most relevant in scenarios where a renderer compromise is possible or has already occurred.

Q: Which Chrome versions are affected?

The vulnerable condition affects Google Chrome versions prior to 151.0.7922.169. Updating Chrome to 151.0.7922.169 or later addresses the affected version range.

Q: What is the security impact of successful exploitation?

A successful exploit can bypass Chrome site isolation after the renderer process has been compromised. This could weaken the separation that site isolation is intended to provide between sites.

Published Aug 18, 2026

Updated

Inappropriate implementation in CORS in Google Chrome prior to 151.0.7922.169 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: High)

Affected Software

1 affected component

Google Chrome<151.0.7922.169

Event History

Aug 18, 2026

CVE Published

via MITRE·08:31 PM

Data Sourced

via MITRE·08:31 PM

DescriptionWeakness

Frequently Asked Questions

What does an attacker need before they can exploit this issue?

Exploitation requires the attacker to have already compromised the Chrome renderer process and to use a crafted HTML page. The issue is therefore most relevant in scenarios where a renderer compromise is possible or has already occurred.

Which Chrome versions are affected?

The vulnerable condition affects Google Chrome versions prior to 151.0.7922.169. Updating Chrome to 151.0.7922.169 or later addresses the affected version range.

What is the security impact of successful exploitation?

A successful exploit can bypass Chrome site isolation after the renderer process has been compromised. This could weaken the separation that site isolation is intended to provide between sites.