CVE-2026-7360: Google Chrome Site Isolation Bypass Flaw

CVE-2026-7360 Overview

CVE-2026-7360 is an insufficient validation of untrusted input vulnerability in the Compositing component of Google Chrome prior to version 147.0.7727.138. This flaw allows a remote attacker who has already compromised the renderer process to bypass site isolation protections via a crafted HTML page. Chromium has classified this vulnerability with High security severity.

Critical Impact
Attackers who have compromised the renderer process can bypass site isolation, potentially allowing cross-origin data access and undermining Chrome's core security architecture.

Affected Products

Google Chrome prior to version 147.0.7727.138
Chromium-based browsers using vulnerable Compositing component
Desktop platforms running affected Chrome versions

Discovery Timeline

2026-04-28 - CVE-2026-7360 published to NVD
2026-04-29 - Last updated in NVD database

Technical Details for CVE-2026-7360

Vulnerability Analysis

This vulnerability resides in the Compositing subsystem of Google Chrome's rendering architecture. The Compositing component is responsible for combining visual elements from different layers and processes to render the final page output. When untrusted input is not properly validated within this component, an attacker who has already achieved renderer compromise can leverage the flaw to bypass site isolation boundaries.

Site isolation is a critical security feature in Chrome that ensures content from different websites runs in separate processes, preventing malicious sites from stealing data from other sites the user is logged into. By exploiting this insufficient input validation, an attacker can circumvent these protections and potentially access sensitive cross-origin information.

Root Cause

The root cause is classified under CWE-20 (Improper Input Validation). The Compositing component fails to adequately validate input received from potentially compromised renderer processes. This allows specially crafted data to pass through validation checks and interact with site isolation mechanisms in unintended ways.

Attack Vector

The attack requires network access and user interaction. An attacker must first achieve renderer compromise through another vulnerability or attack chain. Once the renderer is compromised, the attacker can craft malicious HTML content that exploits the insufficient input validation in the Compositing component.

The attack flow involves:

Attacker compromises the renderer process through a separate vulnerability
Attacker crafts malicious HTML page with specially formatted compositing instructions
Malformed input bypasses validation in the Compositing component
Site isolation protections are circumvented, allowing cross-origin access

The vulnerability mechanism involves insufficient bounds checking and input sanitization within Chrome's Compositing layer. When processing compositor frame data from a compromised renderer, the component fails to properly validate certain properties, allowing the attacker to manipulate how different origin content is composited and potentially leak information across site boundaries. Technical details are available in the Chromium Issue Report #495852034.

Detection Methods for CVE-2026-7360

Indicators of Compromise

Unusual cross-origin data access patterns in browser logs
Anomalous compositing behavior or rendering artifacts
Unexpected inter-process communication between renderer processes
Memory access patterns indicating site isolation bypass attempts

Detection Strategies

Monitor Chrome installations for versions prior to 147.0.7727.138
Implement endpoint detection rules for unusual renderer process behavior
Deploy network monitoring to identify crafted HTML page delivery
Use browser extension policies to restrict access to untrusted content

Monitoring Recommendations

Enable Chrome's crash reporting to detect exploitation attempts
Monitor system logs for unusual Chrome process interactions
Implement asset inventory to track Chrome versions across the organization
Review browser telemetry for abnormal compositing operations

How to Mitigate CVE-2026-7360

Immediate Actions Required

Update Google Chrome to version 147.0.7727.138 or later immediately
Enable automatic Chrome updates across the organization
Audit all Chromium-based browsers for vulnerable versions
Consider restricting access to untrusted websites until patching is complete

Patch Information

Google has released a security update addressing this vulnerability. Users should update to Chrome version 147.0.7727.138 or later. The patch details are available in the Google Chrome Release Update.

Organizations using enterprise Chrome deployments should push the update through their management systems as a priority. The fix addresses the input validation issue in the Compositing component to prevent site isolation bypass from compromised renderer processes.

Workarounds

Enable Site Isolation for all sites using Chrome enterprise policies
Restrict browsing to trusted domains until patches are applied
Consider using alternative browsers temporarily for sensitive operations
Implement network-level controls to block known malicious HTML content delivery

bash

# Chrome Enterprise Policy Configuration
# Enable strict site isolation
chrome_policies.json:
{
  "SitePerProcess": true,
  "IsolateOrigins": "https://sensitive-sites.example.com",
  "BrowserSwitcherEnabled": false
}

# Update Chrome via command line (Windows)
# GoogleUpdate.exe /ua /installsource scheduler

# Verify Chrome version
# chrome://version