CVE-2026-9903

MediumCVSS 5.0/10Last modified Jul 21, 2026

Description

Insufficient validation of untrusted input in Site Isolation in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted MHTML page. (Chromium security severity: High)

Metrics

CVSS 3.1 5.0/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-20

Affected software

No affected versions have been published.

Timeline

Published
May 28, 2026
Last modified
Jul 21, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-990307.5In the Linux kernel, the following vulnerability has been resolved: net: skbuff: don't leave stale bytes in skb_copy_and_csum_bits() When CVE-2026-99031In the Linux kernel, the following vulnerability has been resolved: net: bridge: avoid recursive multicast port cleanup br_multicast_sg_deCVE-2026-990327.8In the Linux kernel, the following vulnerability has been resolved: net/smc: protect clcsock lifetime in smc_getname smc_getname() dereferCVE-2026-99033In the Linux kernel, the following vulnerability has been resolved: net/packet: guard the ll header push in packet_rcv_spkt() packet_rcv_sCVE-2026-99034In the Linux kernel, the following vulnerability has been resolved: mmc: sdhci-sprd: disable runtime PM on remove sdhci_sprd_probe() enablCVE-2026-99035In the Linux kernel, the following vulnerability has been resolved: mmc: mtk-sd: Cancel request timeout work on remove The driver queues rCVE-2026-99036In the Linux kernel, the following vulnerability has been resolved: dm: fix reading free memory in do_resume When do_resume calls dm_tableCVE-2026-99037In the Linux kernel, the following vulnerability has been resolved: dm-crypt: reject the lmk IV mode with AEAD ciphers A "capi:" table linCVE-2026-99038In the Linux kernel, the following vulnerability has been resolved: memstick: rtsx_usb_ms: complete requests after eject instead of droppinCVE-2026-99039In the Linux kernel, the following vulnerability has been resolved: memstick: core: wait for request completion before freeing card In memCVE-2026-99048.3Use after free in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to potentially perform a sandbox escape via a craCVE-2026-99040In the Linux kernel, the following vulnerability has been resolved: KEYS: Fix add_key() race with keyring restriction __key_create_or_upda
CVE-2026-9903: Medium severity, CVSS 5.0 | Vulnix