Description
Improper resource exposure in Preload in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)
Published: 2026-08-25
Score: 3.1 Low
EPSS: < 1% Very Low
KEV: No
Impact: Remote site isolation bypass allowing cross‑site data exposure
Action: Update Chrome
AI Analysis

Impact

A crafted HTML page can trigger an improper resource exposure in the Preload feature of Google Chrome prior to version 152.0.7977.65, allowing a remote attacker to bypass Chrome’s site isolation. The result is that an attacker could access or inject content into a different site’s isolated context, potentially exposing sensitive data or injecting malicious code. The weakness is identified as CWE‑668: Improper Resource Exposure.

Affected Systems

All users running Google Chrome versions earlier than 152.0.7977.65 are affected. The vulnerability is limited to desktop Chrome installations that support the Preload feature.

Risk and Exploitability

The CVE has a CVSS score of 3.1 (Medium). The EPSS score is below 1%, indicating a low exploitation probability, and it is not listed in CISA’s KEV catalog. The attack vector is inferred to be remote, relying on a malicious HTML page that a user must visit. Bypassing site isolation could allow attackers to read or manipulate content across site boundaries, posing a significant confidentiality and integrity risk.

Generated by OpenCVE AI on August 28, 2026 at 18:57 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest Chrome update that includes version 152.0.7977.65 or later, which removes the improper resource exposure in Preload.
  • Disable the Preload feature through Chrome flags or enterprise policy until an official update is applied.
  • Enforce site isolation via Chrome policy or flags to prevent isolated domains from accessing each other through preloaded resources.

Generated by OpenCVE AI on August 28, 2026 at 18:57 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4771-1 chromium security update
Debian DSA Debian DSA DSA-6482-1 chromium security update
History

Fri, 28 Aug 2026 19:15:00 +0000

Type Values Removed Values Added
Title Remote bypass of Chrome site isolation via improper resource exposure in Preload

Fri, 28 Aug 2026 14:45:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*

Thu, 27 Aug 2026 18:00:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 3.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N'}

Tue, 25 Aug 2026 23:30:00 +0000

Type Values Removed Values Added
Title Remote bypass of Chrome site isolation via improper resource exposure in Preload
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Tue, 25 Aug 2026 20:30:00 +0000

Type Values Removed Values Added
Description Improper resource exposure in Preload in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)
Weaknesses CWE-668
References

Subscriptions

Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-08-27T19:08:34.842Z

Reserved: 2026-08-25T06:08:00.562Z

Link: CVE-2026-79031

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Analyzed

Published: 2026-08-25T21:17:59.023

Modified: 2026-08-28T14:38:34.177

Link: CVE-2026-79031

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-28T19:00:11Z

Weaknesses
  • CWE-668

    Exposure of Resource to Wrong Sphere