CVE-2026-13024

chromium-browser: chromium-browser: Insufficient validation of untrusted input in Navigation

View on CVE.org
Published Jun 24, 2026 CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed
Description
Insufficient validation of untrusted input in Navigation in Google Chrome prior to 149.0.7827.197 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: High)

Analysis

AI-generated

Technical impact

Insufficient validation of untrusted input in Chrome's navigation component allows an attacker who has already compromised the renderer process to bypass site isolation by loading a specially crafted HTML page. This flaw can enable the attacker to access or control web content that should be isolated, potentially leading to cross-origin data leaks or execution of malicious code within unintended sites.

Affected Systems

Google Chrome versions earlier than 149.0.7827.197 are vulnerable. The affected product is Google Chrome; versions prior to 149.0.7827.197 should be upgraded to a fixed release.

Risk and Exploitability

The vulnerability is rated with a CVSS score of 4.2, indicating low severity, and its EPSS score is 0.00146 (less than 1%), indicating a very low but non-zero likelihood of exploitation. It is not listed in the CISA KEV catalog. Exploitation requires the attacker to first gain control of the renderer process, a non-trivial prerequisite. If achieved, the flaw can be leveraged to bypass browser security boundaries and potentially compromise isolation guarantees.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update Google Chrome to version 149.0.7827.197 or later.
  • Enable site isolation through Chrome flags or equivalent settings as a temporary mitigator.
  • Apply content-filtering or browser extension policies to block loading of untrusted HTML content until the update is available.

Generated by OpenCVE AI on June 29, 2026 at 13:53 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DLA Debian DLA DLA-4654-1 chromium security update
Debian DSA Debian DSA DSA-6364-1 chromium security update
History
Type Values Removed Values Added
Title chromium-browser: chromium-browser: Insufficient validation of untrusted input in Navigation
Weaknesses CWE-1286
References
Metrics threat_severity

None

 threat_severity

Important
Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome
Type Values Removed Values Added
Title Remote Attacker Can Bypass Site Isolation via Crafted HTML Page in Google Chrome
Type Values Removed Values Added
Title Remote Attacker Can Bypass Site Isolation via Crafted HTML Page in Google Chrome
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 4.2, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description Insufficient validation of untrusted input in Navigation in Google Chrome prior to 149.0.7827.197 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: High)
Weaknesses CWE-20
References
Earlier changes (1)
Weaknesses
  • CWE-1286

    Improper Validation of Syntactic Correctness of Input

  • CWE-20

    Improper Input Validation

Sources

Status
PUBLISHED
Assigner
Chrome
Published
Updated
Jun 24, 2026, 7:29 PM
Reserved
Jun 23, 2026, 5:14 PM

View source JSON

Updated
Jun 24, 2026, 7:29 PM

JSON

Status
Analyzed
Published
Jun 24, 2026, 7:17 PM
Modified
Oct 25, 2026, 10:10 PM

View source JSON

Severity
Important
Public date
Jun 24, 2026, 6:43 PM

View source Bugzilla JSON

Updated
Jun 29, 2026, 2:00 PM

JSON