Executive brief
Google Chrome's StorageAccessAPI component fails to properly validate user input, allowing an attacker who has already compromised the browser's renderer process to bypass web origin policies. This could enable unauthorized access to cross-origin storage and data, potentially exposing user information and enabling account takeover attacks.
Technical details
The vulnerability exists in StorageAccessAPI within Google Chrome versions prior to 152.0.7977.65, where improper input validation allows a remote attacker who has compromised the renderer process to bypass web origin policy enforcement through a specially crafted HTML page. The StorageAccessAPI is responsible for managing cross-origin storage access permissions. An attacker would need to have already achieved renderer process compromise (e.g., through a separate vulnerability), then leverage this input validation flaw to escalate privileges and bypass security boundaries. The fix is available in Chrome 152.0.7977.65 and later versions.
Affected products
- Google Chrome prior to 152.0.7977.65
Timeline
- 2026-08-25: disclosed
- 2026-08-25: patched: Chrome 152.0.7977.65 released