CVE-2026-15130: Google Chrome Auth Bypass Vulnerability

CVE-2026-15130 Overview

CVE-2026-15130 is a site isolation bypass in the Navigation component of Google Chrome. Versions prior to 150.0.7871.115 fail to enforce navigation policy correctly, allowing a remote attacker to bypass site isolation via a crafted HTML page. The Chromium project rated the internal severity as High, while the NVD scoring reflects a lower impact due to limited confidentiality effect and required user interaction. The weakness is tracked as CWE-602: Client-Side Enforcement of Server-Side Security. No public exploit or in-the-wild activity has been reported.

Critical Impact
A crafted HTML page can bypass Chrome site isolation, weakening a core browser boundary that separates content from different origins and enabling downstream cross-origin information exposure.

Affected Products

Google Chrome for Desktop prior to 150.0.7871.115
Chromium-based browsers inheriting the vulnerable Navigation code path
Embedded frameworks bundling pre-patch Chromium builds

Discovery Timeline

2026-07-08 - CVE-2026-15130 published to NVD
2026-07-09 - Last updated in NVD database

Technical Details for CVE-2026-15130

Vulnerability Analysis

The flaw exists in Chrome's Navigation stack, which coordinates how the browser assigns documents to renderer processes. Site isolation relies on strict policy enforcement so that documents from different sites are placed in separate processes with independent memory spaces. When that enforcement is incomplete, an attacker can influence the browser into treating a navigation as belonging to the wrong origin boundary. The result is a weakening of the same-site process boundary that underpins Spectre-class defenses and cross-origin data protections.

Exploitation requires user interaction, such as visiting an attacker-controlled page. The attack vector is network-based and does not require privileges or authentication. Impact is limited to confidentiality, with no direct integrity or availability effect according to the assigned CVSS vector.

Root Cause

The root cause is insufficient policy enforcement during navigation decisions, categorized under [CWE-602]. The browser accepts a client-supplied or attacker-influenced navigation state without fully validating it against server-authoritative site isolation policy. Full technical details are restricted in the Chromium Issue Tracker Entry pending broad patch adoption.

Attack Vector

An attacker hosts a crafted HTML page and lures a target to load it. The page triggers a navigation sequence that the Navigation component fails to constrain to the correct site isolation boundary. Once the boundary is bypassed, cross-origin content that should be isolated may become reachable within a shared renderer, enabling secondary attacks such as cross-site data inference. See the Google Chrome Stable Update advisory for the vendor summary.

No verified proof-of-concept code has been released. See the referenced Chromium tracker for technical details once access restrictions are lifted.

Detection Methods for CVE-2026-15130

Indicators of Compromise

Chrome browser processes running versions earlier than 150.0.7871.115 observed via endpoint inventory telemetry.
Browser navigation to newly registered or low-reputation domains hosting crafted HTML content, followed by anomalous cross-origin subresource loads.
Unexpected renderer process consolidation where distinct sites share a process contrary to site isolation policy.

Detection Strategies

Inventory installed Chrome and Chromium-derived browser versions across managed endpoints and flag builds below 150.0.7871.115.
Correlate web proxy logs with endpoint browser telemetry to identify users visiting suspicious HTML pages that trigger uncommon cross-origin navigation patterns.
Alert on browser crash dumps or renderer errors referencing navigation or site instance mismatches, which may indicate exploitation attempts.

Monitoring Recommendations

Ingest browser version telemetry into your SIEM and build a dashboard tracking patch compliance against 150.0.7871.115.
Monitor DNS and HTTP proxy logs for user visits to newly seen domains hosting HTML payloads that fail typical content reputation checks.
Track Chrome update service events to confirm automatic updates are applying successfully across the fleet.

How to Mitigate CVE-2026-15130

Immediate Actions Required

Update Google Chrome to version 150.0.7871.115 or later on all Windows, macOS, and Linux endpoints.
Force a browser restart after update deployment to ensure the patched binaries load for all active sessions.
Audit Chromium-based browsers and embedded WebView components for equivalent patched builds and update them accordingly.

Patch Information

Google released the fix in the Chrome Stable channel at version 150.0.7871.115. Refer to the Google Chrome Stable Update advisory for full channel details. Enterprise administrators should validate that Chrome's automatic update mechanism is enabled and not blocked by group policy.

Workarounds

Restrict browsing to trusted sites via enterprise URL allowlists until patching completes.
Enable strict site isolation policy via the IsolateOrigins and SitePerProcess enterprise policies to reinforce boundary enforcement on unpatched hosts.
Deploy web content filtering to block newly registered or low-reputation domains that could host crafted HTML payloads.

bash

# Verify Chrome version on Linux endpoints
google-chrome --version

# Windows enterprise policy snippet enforcing site isolation
# HKLM\Software\Policies\Google\Chrome
#   SitePerProcess = 1 (DWORD)
#   IsolateOrigins = "https://sensitive.example.com,https://auth.example.com"