CVE-2026-95301 is a vulnerability in Google Chrome where missing authorization checks in the Extensions component prior to version 154.0.8037.57 permit a remote attacker, with control over the renderer process, to bypass site isolation protections by leveraging a crafted HTML page. This flaw undermines Chrome's security boundary between sites, potentially allowing unauthorized access or data leakage across site contexts.

The vulnerability allows an attacker who has already compromised the renderer process to bypass site isolation, a key security feature designed to separate web content from different origins. This could lead to unauthorized access to data or code execution across site boundaries within the browser. The Chromium security team rates this issue as high severity, indicating significant security implications if exploited.

A fix is available in Google Chrome version 154.0.8037.57. Users and administrators should update to this version or later to remediate the vulnerability. Refer to the official Google Chrome stable channel update advisory for confirmation and update instructions: https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0856730748.html