CVE-2026-95287 is a missing authorization vulnerability in the Navigation feature of Google Chrome before version 154.0.8037.57. It enables a remote attacker with control over the renderer process to bypass site isolation protections by leveraging a specially crafted HTML page. Site isolation is a security feature designed to prevent cross-site data leaks by isolating different sites into separate processes. The vulnerability was publicly disclosed and patched by Google in the stable channel update 154.0.8037.57.

An attacker who has already compromised the renderer process can exploit this vulnerability to bypass site isolation, potentially allowing access to data from other sites that should be isolated. This undermines one of Chrome's key security mechanisms designed to protect user data from cross-site attacks. However, exploitation requires prior compromise of the renderer process.

Users should update Google Chrome to version 154.0.8037.57 or later, where this vulnerability has been fixed. No additional mitigation is required once the update is applied.