{"id":"CVE-2026-126850","kind":"vulnerability","aliases":["CVE-2026-126850"],"related":[],"title":"Chrome on Android: site isolation flaw lets a compromised renderer read data","description":"Incorrect authorization in SiteIsolation in Google Chrome on on Android prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: High)","summary":"Google Chrome on Android before 157.0.8103.78 has an authorization flaw in its SiteIsolation component. A remote attacker who has already compromised the renderer process can obtain sensitive information through a crafted HTML page.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["android","chrome","other"],"not_affected_if":["chrome-up-to-date"],"how_to_check":"- Open Chrome on Android, go to Settings > About Chrome, and compare the version with `157.0.8103.78`","fix":"- Google Chrome on Android: `157.0.8103.78` or later","status":"open","published_at":"2026-11-11T23:17:12+00:00","first_seen_at":"2026-11-11T23:29:36+00:00","triaged_at":"2026-11-11T23:33:40+00:00","updated_at":"2026-11-11T23:33:40+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-11T23:33:40Z","model":"claude-haiku-5-5","output":{"fix":"- Google Chrome on Android: `157.0.8103.78` or later","reach":"internet","title":"Chrome on Android: site isolation flaw lets a compromised renderer read data","impact":"medium","summary":"Google Chrome on Android before 157.0.8103.78 has an authorization flaw in its SiteIsolation component. A remote attacker who has already compromised the renderer process can obtain sensitive information through a crafted HTML page.","audience":"everyone","category":"other","nicknames":[],"who_cares":["chrome","android"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Sensitive information leaks from the browser after renderer compromise","analyst_note":"","how_to_check":"- Open Chrome on Android, go to Settings > About Chrome, and compare the version with `157.0.8103.78`\n- unknown for any other check","plain_action":"Update Chrome on your Android phone to version 157.0.8103.78 or newer.","product_name":"","needs_analyst":false,"not_affected_if":["chrome-up-to-date"],"who_is_affected":"Android devices running Chrome older than 157.0.8103.78. The attacker must first compromise the browser's renderer process, so this chains with another flaw. Desktop Chrome and other platforms are not stated by the source.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000705,"input_tokens":4544,"output_tokens":502,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-126850':15A,18A '-2026':14A,17A '157.0.8103.78':26B,66C 'allow':67C 'alreadi':40B 'android':3A,19B,24B,63C 'attack':37B,70C 'author':29B,55C 'chrome':1A,20B,22B,60C 'chromium':86C 'compon':34B 'compromis':9A,41B,73C 'craft':51B,83C 'cve':13A,16A 'data':12A 'flaw':6A,30B 'googl':21B,59C 'high':89C 'html':52B,84C 'incorrect':54C 'inform':48B,80C 'isol':5A 'let':7A 'obtain':46B,78C 'page':53B,85C 'prior':64C 'process':44B,76C 'read':11A 'remot':36B,69C 'render':10A,43B,75C 'secur':87C 'sensit':47B,79C 'sever':88C 'site':4A 'siteisol':33B,57C 'via':81C","nicknames":[],"mitigations":[],"who_affected":"Android devices running Chrome older than 157.0.8103.78. The attacker must first compromise the browser's renderer process, so this chains with another flaw. Desktop Chrome and other platforms are not stated by the source.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update Chrome on your Android phone to version 157.0.8103.78 or newer.","pkeys":[],"ptokens":[],"labels":["android","chrome","high","other"],"campaign_type":null,"search_a":"'-126850':15A,18A '-2026':14A,17A 'android':3A 'chrome':1A 'compromis':9A 'cve':13A,16A 'data':12A 'flaw':6A 'isol':5A 'let':7A 'read':11A 'render':10A 'site':4A","search_b":"'157.0.8103.78':26B 'alreadi':40B 'android':19B,24B 'attack':37B 'author':29B 'chrome':20B,22B 'compon':34B 'compromis':41B 'craft':51B 'flaw':30B 'googl':21B 'html':52B 'inform':48B 'obtain':46B 'page':53B 'process':44B 'remot':36B 'render':43B 'sensit':47B 'siteisol':33B","search_c":"'157.0.8103.78':66C 'allow':67C 'android':63C 'attack':70C 'author':55C 'chrome':60C 'chromium':86C 'compromis':73C 'craft':83C 'googl':59C 'high':89C 'html':84C 'incorrect':54C 'inform':80C 'obtain':78C 'page':85C 'prior':64C 'process':76C 'remot':69C 'render':75C 'secur':87C 'sensit':79C 'sever':88C 'siteisol':57C 'via':81C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T23:17:12+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126850","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126850","severity":null,"published_at":"2026-11-11T23:17:12+00:00","modified_at":"2026-11-11T23:17:13+00:00","first_seen_at":"2026-11-11T23:29:36+00:00","fetched_at":"2026-11-11T23:29:36+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}