Description
Inappropriate implementation in Input in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: High)
Published: 2026-05-28
Score: 5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A crafted HTML page exploits an inappropriate input handling routine in Google Chrome for Android, exposing weaknesses identified as CWE‑346 and CWE‑653. This flaw enables an attacker who has already compromised the renderer process to bypass the browser’s site isolation safeguards.

Affected Systems

The flaw exists in Google Chrome for Android versions prior to 148.0.7778.216. Devices running any earlier version are susceptible until the next update is installed.

Risk and Exploitability

It is not stated whether a public exploit has been disclosed, and the EPSS score is below 1%, indicating very low observed exploitation probability. The vulnerability is not listed in CISA KEV. However, it requires the attacker to first gain control of the renderer process, which could occur through other browser or system weaknesses. Once that condition is met, bypassing site isolation offers significant opportunities for further attacks within the browser session. The CVSS score of 5 reflects a moderate impact for an affected user.

Generated by OpenCVE AI on May 29, 2026 at 20:07 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update Chrome for Android to version 148.0.7778.216 or later, which applies the fixed input handling logic.
  • If an immediate update is not feasible, disable or restrict third‑party sites from running in separate renderer processes by using browser flags or policy‑based isolation settings.
  • Consider switching to a browser implementation that enforces stricter isolation until Chrome can be upgraded, or restrict the device’s network access to reduce the likelihood of remote content triggers.

Generated by OpenCVE AI on May 29, 2026 at 20:07 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DSA Debian DSA DSA-6316-1 chromium security update
History

Wed, 03 Jun 2026 02:30:00 +0000

Type Values Removed Values Added
First Time appeared Google android
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
cpe:2.3:o:google:android:-:*:*:*:*:*:*:*
Vendors & Products Google android

Fri, 29 May 2026 18:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-346
Metrics cvssV3_1

{'score': 5.8, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N'}

 ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

cvssV3_1

{'score': 5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L'}

Fri, 29 May 2026 16:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
CWE-305

Fri, 29 May 2026 12:15:00 +0000

Type Values Removed Values Added
Title Chrome Android Site Isolation Bypass via Crafted HTML chromium-browser: Inappropriate implementation in Input
Weaknesses CWE-653
References
Metrics threat_severity

None

 cvssV3_1

{'score': 5.8, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N'}

threat_severity

Important

Thu, 28 May 2026 23:45:00 +0000

Type Values Removed Values Added
Title Chrome Android Site Isolation Bypass via Crafted HTML
First Time appeared Google
Google chrome
Weaknesses CWE-284
CWE-305
Vendors & Products Google
Google chrome

Thu, 28 May 2026 22:45:00 +0000

Type Values Removed Values Added
Description Inappropriate implementation in Input in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: High)
References

Subscriptions

Google Android Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-05-29T17:39:16.696Z

Reserved: 2026-05-28T17:25:13.604Z

Link: CVE-2026-10010

cve-icon Vulnrichment

Updated: 2026-05-29T17:39:06.378Z

cve-icon NVD

Status : Analyzed

Published: 2026-05-28T23:16:42.840

Modified: 2026-06-03T02:31:06.417

Link: CVE-2026-10010

cve-icon Redhat

Severity : Important

Publid Date: 2026-05-27T00:00:00Z

Links: CVE-2026-10010 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-05-29T20:15:07Z

Weaknesses
  • CWE-346

    Origin Validation Error

  • CWE-653

    Improper Isolation or Compartmentalization