CVE-2026-8568

chromium-browser: chromium-browser: Insufficient policy enforcement in AI

View on CVE.org
Published May 14, 2026 CVSS 3.1 · 6.2 Medium EPSS n/a KEV · Not listed
Description
Determined not a vulnerability

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DSA Debian DSA DSA-6273-1 chromium security update
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description Insufficient policy enforcement in AI in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to bypass Site Isolation via a crafted HTML page. (Chromium security severity: Medium) Determined not a vulnerability
Type Values Removed Values Added
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
Type Values Removed Values Added
Weaknesses CWE-275
CWE-276
Type Values Removed Values Added
Weaknesses CWE-693
Metrics cvssV3_1

{'score': 6.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N'}

 ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

cvssV3_1

{'score': 3.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N'}
Type Values Removed Values Added
Title Bypass of Site Isolation via AI Policy Enforcement Flaw in Google Chrome chromium-browser: chromium-browser: Insufficient policy enforcement in AI
Weaknesses CWE-1100
References
Metrics threat_severity

None

 cvssV3_1

{'score': 6.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N'}

threat_severity

Moderate
Type Values Removed Values Added
Title Bypass of Site Isolation via AI Policy Enforcement Flaw in Google Chrome
Weaknesses CWE-275
CWE-276
Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome
Type Values Removed Values Added
Description Insufficient policy enforcement in AI in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to bypass Site Isolation via a crafted HTML page. (Chromium security severity: Medium)
References
Earlier changes (4)
Weaknesses

Sources

Status
REJECTED
Assigner
Chrome
Published
Updated
Jun 16, 2026, 9:20 PM
Reserved
May 14, 2026, 5:40 AM

View source JSON

Updated

JSON

Status
Rejected
Published
May 14, 2026, 8:17 PM
Modified
Jun 17, 2026, 1:21 PM

View source JSON

Severity
Moderate
Public date
May 14, 2026, 7:52 PM

View source Bugzilla JSON

No data.