{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-7360", "assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28", "state": "PUBLISHED", "assignerShortName": "Chrome", "dateReserved": "2026-04-28T20:02:48.922Z", "datePublished": "2026-04-28T22:35:55.821Z", "dateUpdated": "2026-04-28T22:35:55.821Z"}, "containers": {"cna": {"affected": [{"vendor": "Google", "product": "Chrome", "versions": [{"version": "147.0.7727.138", "status": "affected", "lessThan": "147.0.7727.138", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "Insufficient validation of untrusted input. in Compositing in Google Chrome prior to 147.0.7727.138 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: High)"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Insufficient validation of untrusted input", "cweId": "CWE-20"}]}], "providerMetadata": {"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28", "shortName": "Chrome", "dateUpdated": "2026-04-28T22:35:55.821Z"}, "references": [{"url": "https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop_28.html"}, {"url": "https://issues.chromium.org/issues/495852034"}]}}}

{}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Insufficient validation of untrusted input. in Compositing in Google Chrome prior to 147.0.7727.138 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: High)"}], "id": "CVE-2026-7360", "lastModified": "2026-04-28T23:16:23.570", "metrics": {}, "published": "2026-04-28T23:16:23.570", "references": [{"source": "chrome-cve-admin@google.com", "url": "https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop_28.html"}, {"source": "chrome-cve-admin@google.com", "url": "https://issues.chromium.org/issues/495852034"}], "sourceIdentifier": "chrome-cve-admin@google.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}], "source": "chrome-cve-admin@google.com", "type": "Primary"}]}

{"bugzilla": {"description": "chromium-browser: Insufficient validation of untrusted input in Compositing", "id": "2463677", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463677"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.7", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N", "status": "draft"}, "cwe": "CWE-1173", "details": ["An insufficient validation of untrusted input flaw was found in the Compositing component of the Chromium browser.\nUpstream bug(s):\nhttps://code.google.com/p/chromium/issues/detail?id=495852034"], "name": "CVE-2026-7360", "public_date": "2026-04-28T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-7360\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-7360\nhttps://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop_28.html\nhttps://issues.chromium.org/issues/495852034"], "statement": "Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[147.0.7727.138,147.0.7727.138)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Chrome", "source": "cna", "vendor": "Google"}, "product": "chrome", "vendor": "google"}], "analysis": {"en": {"generated_at": "2026-04-29T01:11:03.595856+00:00", "value": {"mitigation_remediation": ["Upgrade Google Chrome to version 147.0.7727.138 or later.", "Verify that site isolation is enabled in Chrome settings or through policy to prevent accidental cross\u2011site attacks.", "Avoid opening untrusted or suspicious HTML content from untrusted sources until a patch is applied."], "summary": {"action": "Patch Immediately", "impact": "Site isolation bypass"}, "threat_synthesis": {"affected_systems": "Affected versions are all releases of Google Chrome before 147.0.7727.138. The problem does not exist in later releases where the patch has been applied.", "description_and_impact": "The vulnerability arises from insufficient validation of untrusted input in the compositing component of Chrome. An attacker who has compromised a renderer process can supply a specially crafted HTML page that bypasses Chrome\u2019s site isolation, allowing that process to access resources belonging to other sites. This effectively lifts the isolation boundary and can lead to data theft, credential compromise, or other attacks against users while Chrome is running. The flaw is classified as CWE\u201120 and is rated high severity by Chromium.", "risk_and_exploitability": "Because the exploit requires an attacker to first compromise the renderer process, the risk is lower than a purely remote exploit, and the EPSS score is unavailable. The CVSS score is not listed here, but the vulnerability is marked high severity and is not in CISA\u2019s KEV catalog. In practice, the attack vector is a crafted HTML page delivered to a user who has already compromised a renderer, possibly via drive\u2011by or malicious add\u2011ons, making the threat more limited but still significant for affected Chrome users."}}}}, "created": "2026-04-29T00:45:25.883433+00:00", "title": "Chrome Site Isolation Bypass via Input Validation Flaw", "updated": "2026-04-29T01:15:44.712867+00:00", "vendors": ["google", "google$PRODUCT$chrome"]}