EUVD-2026-40709
GHSA-48x8-q2fp-cpc8
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
AC:H reflects the explicit renderer-compromise prerequisite; all other metrics from provided vector are retained as accurate for the StorageAccessAPI bypass itself.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Insufficient policy enforcement in StorageAccessAPI in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Cross-origin data leakage in Google Chrome's StorageAccessAPI (prior to 150.0.7871.47) enables a remote attacker who has already compromised the renderer process to read storage or cookie data belonging to other origins by delivering a crafted HTML page. This is a chained attack - the StorageAccessAPI policy bypass is the second stage of a multi-step compromise, not a standalone entry point. EPSS is very low (0.17%, 7th percentile), no active exploitation is confirmed in CISA KEV, and no public exploit code has been identified at time of analysis.
Technical ContextAI
The StorageAccessAPI is a W3C browser API that allows cross-origin embedded content (e.g., iframes) to programmatically request access to first-party storage, typically gated by browser policy and user interaction. Google Chrome's implementation prior to 150.0.7871.47 contained insufficient policy enforcement (CWE-20: Improper Input Validation) within this API surface, meaning that a renderer process operating outside its expected trust boundary could bypass the cross-origin isolation policies that normally prevent one origin from reading another's storage, cookies, or session data. The affected versions span all Chrome desktop installations prior to the 150.0.7871.47 stable channel release, as documented in the EUVD entry EUVD-2026-40709.
RemediationAI
Update Google Chrome to version 150.0.7871.47 or later; this is the vendor-confirmed fix as documented in the stable channel update advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Chrome's auto-update mechanism will deliver this silently for most end users; enterprise administrators managing Chrome via Group Policy or Google Admin Console should verify deployment using the chrome://version endpoint or fleet management tooling. As a compensating control where immediate update is not feasible, organizations can restrict access to untrusted web content via enterprise browser policies (e.g., URL allowlisting) or disable cross-origin iframe embedding through Content-Security-Policy headers on sensitive applications - this limits the surface a compromised renderer could leverage the StorageAccessAPI against. Note that the prerequisite renderer compromise must be independently addressed; patching CVE-2026-14021 alone does not close the broader renderer attack surface.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today