Google Chrome EUVD-2026-66046

Exploitation requires two preconditions: (1) the attacker must have already compromised the Chrome renderer process via a separate vulnerability - this is an explicit prerequisite stated in the description and is not achievable through this CVE alone; and (2) the victim user must navigate to or be redirected to a crafted HTML page (UI:R confirmed by CVSS). Limiting factors include: the renderer compromise barrier is a high-complexity prerequisite; the scope change is limited to origin policy bypass for storage access with no confidentiality impact (C:N per CVSS) and no availability impact (A:N); and the flaw does not facilitate OS-level sandbox escape. This is not exploitable against default Chrome installations without a chained renderer RCE. Non-default configurations or specific API usage patterns within affected pages are not required beyond the renderer compromise prerequisite.

Real-world risk is substantially lower than the raw CVSS 6.5 suggests. The official CVSS vector (AV:N/AC:L/PR:N/UI:R) models the outer delivery mechanism but does not capture the renderer compromise prerequisite, creating a meaningful disconnect - AC:L/PR:N implies straightforward network exploitation against any user who visits a page, while the description explicitly requires prior renderer process compromise, which is itself a high-complexity, typically high-severity prerequisite. Chromium's own team rated this 'Low' severity, which better reflects the chained nature. EPSS at 0.23% (14th percentile) aligns with the Chromium team's assessment. There is no KEV listing and no public exploit code identified. This vulnerability is most relevant as a privilege escalation step within a multi-stage browser exploit chain (e.g., renderer RCE followed by this origin bypass), not as a first-entry vector. Defenders should prioritize patching Chrome to eliminate the foothold, but this CVE alone does not warrant emergency response absent renderer-level exploitation in the environment.

An attacker who has already achieved renderer process compromise (via a separate, likely more severe Chrome RCE vulnerability) delivers a crafted HTML page to the victim's browser. The page triggers the StorageAccessAPI authorization flaw, allowing the compromised renderer to access storage data across web origins it should not be permitted to read or modify, potentially enabling session hijacking or cross-origin data tampering. No public proof-of-concept code for this specific CVE has been identified.