CVE-2026-78903: Incomplete cleanup in Google Chrome

This vulnerability involves incomplete cleanup in the SiteIsolation implementation in Google Chrome versions before 152.0.7977.65. An attacker who has already compromised the renderer process can exploit this flaw to bypass site isolation protections by using a specially crafted HTML page. The issue was assigned a medium security severity by Chromium but has a CVSS v3.1 base score of 3.1, indicating low overall impact. No known exploits are reported in the wild. The vulnerability was publicly disclosed with a vendor advisory linked to the Chrome stable channel update blog.

The impact is limited to a remote attacker who has already compromised the renderer process. Such an attacker can bypass site isolation protections, potentially increasing the risk of cross-site data leaks or other security boundary violations within the browser. The confidentiality impact is low, with no integrity or availability impacts reported.

A fix is available in Google Chrome version 152.0.7977.65. Users and administrators should update to this version or later to remediate the vulnerability. Refer to the official Google Chrome stable channel update advisory for details: https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0256176589.html