EUVD-2026-40842
GHSA-r7cf-wj4w-p5cq
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Network-delivered via crafted page requiring victim interaction; no attacker privileges needed; confidentiality high for cross-origin data leak; scope unchanged as the browser process does not escalate to another security authority.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Insufficient policy enforcement in StorageAccessAPI in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)
AnalysisAI
Cross-origin data leakage in Google Chrome prior to 150.0.7871.47 exposes sensitive user data from other origins when a victim visits a specially crafted HTML page that exploits insufficient policy enforcement in the StorageAccessAPI. The API, designed to manage third-party storage access in privacy-restricting browser contexts, fails to enforce cross-origin boundaries correctly, allowing an attacker to read data belonging to unrelated origins. No active exploitation has been confirmed - CVE is absent from CISA KEV, EPSS rates exploitation likelihood at 0.17% (7th percentile), and SSVC classifies exploitation status as none - though the CVSS confidentiality impact is rated High.
Technical ContextAI
The StorageAccessAPI is a W3C browser API that allows embedded cross-origin iframes to request access to first-party storage, primarily introduced to preserve functionality for sites that rely on third-party cookies in privacy-hardened browser configurations. CWE-284 (Improper Access Control) identifies the root cause class: Chrome's policy enforcement layer for this API fails to apply appropriate restrictions, permitting cross-origin reads that the same-origin policy would normally block. The affected product is Google Chrome desktop (cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*) for all versions prior to 150.0.7871.47, as confirmed by ENISA EUVD-2026-40842 and the Chrome stable channel advisory. Notably, Chromium's internal security severity classification rates this as Low, suggesting that while the information disclosure is real, the volume or sensitivity of data extractable in practice may be limited by additional browser mitigations or usage constraints.
RemediationAI
Update Google Chrome to version 150.0.7871.47 or later using Chrome's built-in update mechanism (Settings → About Chrome) or via enterprise deployment tools. The vendor patch is confirmed available per the stable channel advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. For enterprise environments unable to deploy immediately, Chrome enterprise policy can be used to restrict StorageAccessAPI behavior via the DefaultStorageAccessSetting or related content-setting policies, which would prevent cross-origin storage requests from succeeding - note this may break legitimate embedded content from sites that depend on the StorageAccessAPI for single-sign-on or cross-site functionality. Given the Low Chromium severity rating, absence of active exploitation, and non-automatable SSVC classification, this vulnerability is appropriate for inclusion in routine patch cycles rather than out-of-band emergency deployment.
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today