
Proof-of-concept exploit for CVE-2026-87492, a Chromium site isolation bypass using a patched renderer and MojoJS to demonstrate cross-origin data leakage.
Start a server using python3 srver.py, apply a renderer.patch to chromium/src at commit hash 112f665d98a2fe84b156c74fbea2aed742f16c15. Run the patched chrome version with --enable-blink-features=MojoJS and navigate to localhost:3020. Make sure to have [host].localhost support, or some cross site domain that supports ports 3020. # si-bypass-poc