EUVD-2026-66046
GHSA-5mpq-6gpc-2mf3
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
AC:H reflects the mandatory renderer compromise prerequisite; all other metrics align with network delivery, user interaction, and integrity-only impact.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Lifecycle Timeline
4DescriptionCVE.org
Incorrect authorization in StorageAccessAPI in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)
AnalysisAI
Incorrect authorization in Chrome's StorageAccessAPI (versions prior to 152.0.7977.65) enables a renderer-compromised attacker to bypass the web origin policy via a crafted HTML page. This is a chained vulnerability - exploitation is contingent on a prior renderer process compromise, making it a second-stage component in a multi-bug attack chain rather than a standalone threat. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two preconditions: (1) the attacker must have already compromised the Chrome renderer process via a separate vulnerability - this is an explicit prerequisite stated in the description and is not achievable through this CVE alone; and (2) the victim user must navigate to or be redirected to a crafted HTML page (UI:R confirmed by CVSS). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Real-world risk is substantially lower than the raw CVSS 6.5 suggests. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has already achieved renderer process compromise (via a separate, likely more severe Chrome RCE vulnerability) delivers a crafted HTML page to the victim's browser. The page triggers the StorageAccessAPI authorization flaw, allowing the compromised renderer to access storage data across web origins it should not be permitted to read or modify, potentially enabling session hijacking or cross-origin data tampering. … |
| Remediation | Vendor-released patch: Chrome 152.0.7977.65. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today