PatchSiren cyber security CVE debrief
CVE-2026-9903 Google CVE debrief
CVE-2026-9903 is a high-severity Site Isolation bypass in Google Chrome affecting versions prior to 148.0.7778.216. The vulnerability stems from insufficient validation of untrusted input in Chrome's Site Isolation mechanism, allowing a remote attacker who has already compromised the renderer process to bypass site isolation protections via a crafted MHTML page. Site Isolation is a critical security boundary in Chrome that prevents malicious websites from accessing data from other sites; its bypass enables cross-site data exfiltration even from an already-compromised renderer. The Chromium project assigned this a High severity rating. The vulnerability was disclosed in the Chrome Stable Channel update released May 28, 2026, with the underlying Chromium issue tracked as 498783665. No CISA KEV listing or known ransomware campaign use has been identified.
- Vendor
- Product
- Chrome
- CVSS
- MEDIUM 5
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-05-28
- Original CVE updated
- 2026-05-29
- Advisory published
- 2026-05-28
- Advisory updated
- 2026-05-29
Who should care
Organizations with managed Chrome deployments, security teams monitoring browser-based attack chains, and users handling sensitive web sessions across multiple origins. Particularly relevant for environments where MHTML files are commonly exchanged or archived.
Technical summary
The vulnerability exists in Chrome's Site Isolation implementation, which enforces process-level separation between different websites. Insufficient input validation when processing MHTML (MIME HTML) multipart documents allows a compromised renderer process to circumvent these isolation boundaries. MHTML archives can encapsulate multiple web resources; improper validation of origin boundaries within these archives enables the attacker to access cross-site data. This represents a sandbox escape from the renderer process perspective, though exploitation requires prior renderer compromise. The fix in Chrome 148.0.7778.216 adds proper validation of origin contexts within MHTML processing.
Defensive priority
high
Recommended defensive actions
- Upgrade Google Chrome to version 148.0.7778.216 or later across all endpoints.
- Prioritize patching for high-value targets and users handling sensitive cross-site data.
- Monitor for anomalous renderer crashes or unexpected cross-origin data access attempts as potential exploitation indicators.
- Review and restrict MHTML file handling where possible, as this vector requires a crafted MHTML page.
- Await NVD CVSS scoring update for refined risk prioritization.
Evidence notes
Vulnerability description and affected versions confirmed via Chrome Release Blog and Chromium issue tracker. CWE-20 (Improper Input Validation) assigned by Google. CVSS score not yet available from NVD (status: Awaiting Analysis). Vendor identification marked low-confidence due to source domain inference; manual review recommended.
Official resources
2026-05-28