Missing authorization in SiteIsolation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to… (CVE-2026-78953)

CVE-2026-78953 is a vulnerability in Google Chrome's SiteIsolation mechanism present in versions before 152.0.7977.65. The flaw is due to missing authorization checks that enable a remote attacker, who has already compromised the renderer process, to bypass site isolation protections by leveraging a specially crafted PDF file. This could potentially allow the attacker to access data across site boundaries that SiteIsolation is designed to protect.

The impact is limited to confidentiality as indicated by the CVSS vector (C:L/I:N/A:N). The attacker must have already compromised the renderer process and user interaction is required. The vulnerability allows bypassing site isolation, which could lead to unauthorized access to data from other sites within the browser process.

No explicit patch or remediation information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should monitor official Google Chrome security advisories for updates and apply updates once available.