Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
4.2
CVE-2026-17659: Google Chrome: Malicious HTML can bypass site isolation
CVE-2026-17659 · published 3 months ago
Summary
A security issue in older versions of Google Chrome could allow a hacker who has taken control of a website to access other websites that the user has open at the same time. This could lead to sensitive information being stolen or malicious content being displayed. Update to the latest version of Google Chrome to fix this issue.
What to do
- Update debian chromium to version 151.0.7922.71-1~deb12u1.
- Update debian chromium to version 151.0.7922.71-1~deb13u1.
- Update google chrome to version 151.0.7922.72 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:11 | debian | chromium | All versions |
| Debian:12 | debian | chromium |
< 151.0.7922.71-1~deb12u1 Fix: upgrade to 151.0.7922.71-1~deb12u1
|
| Debian:13 | debian | chromium |
< 151.0.7922.71-1~deb13u1 Fix: upgrade to 151.0.7922.71-1~deb13u1
|
| Debian:14 | debian | chromium | All versions |
| – | chrome | < 151.0.7922.72 |
Original advisory text
Inappropriate implementation in SiteIsolation in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML ...
Inappropriate implementation in SiteIsolation in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: High)
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-693Protection Mechanism Failure
Timeline
Published30 Jul 2026
Updated29 Oct 2026
First seen30 Jul 2026
Track software like this
Free during beta