Description

Information leak in StorageAccessAPI in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Low)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-25T21:17:46.963Z",
  "pubdate": "2026-08-25T21:17:46.963Z",
  "executiveSummary": "A vulnerability within the StorageAccessAPI component of Google Chrome enables an information disclosure flaw. The vulnerability allows a remote attacker to circumvent cross-origin policy restrictions, facilitating the unauthorized acquisition of sensitive cross-origin data.\nThe flaw affects Google Chrome versions prior to 152.0.7977.65. Classified with a Low severity rating by Chromium, this vulnerability poses a risk to user data confidentiality by potentially exposing data that should be isolated by the Same-Origin Policy (SOP).\nExploitation requires the victim to interact with a specifically crafted HTML page designed by an attacker. Upon successful execution, the attacker can leverage the browser's storage access mechanics to breach origin boundaries. This exposure does not require prior authentication or elevated privileges, relying instead on the victim navigating to the malicious content to trigger the information leak.",
  "technicalDetails": "The vulnerability resides within the implementation of the StorageAccessAPI, a browser-level mechanism designed to allow embedded content to request and gain access to first-party cookies and storage. The root cause pertains to an insufficient validation of state or origin context during the transition or authorization phase of the storage access request.\nSpecifically, the flaw enables an attacker to influence the API's internal state, leading to a bypass of the security boundaries enforced by the Same-Origin Policy (SOP). In a typical attack flow, a malicious actor hosts a crafted HTML page containing embedded iframes or resources targeting a victim's authenticated session on a different domain. By triggering the StorageAccessAPI in a non-compliant context, the attacker induces the browser to expose cross-origin data that would otherwise be inaccessible to the third-party context.\nThe exploitation process involves the following sequence: 1) The attacker lures a user to a malicious webpage; 2) The page invokes the StorageAccessAPI under conditions that the browser incorrectly validates; 3) The browser's storage subsystem grants access to cross-origin storage tokens or sensitive session data; 4) The malicious script on the attacker's page reads this data and exfiltrates it to an external server via an asynchronous request.\nBecause the StorageAccessAPI is intended to facilitate legitimate cross-site functionality, the vulnerability exploits the trust established between the browser's permission management and the underlying document object model (DOM). The vulnerability does not require the attacker to bypass authentication, as it leverages the victim's existing active sessions. Post-exploitation, the attacker gains the ability to harvest sensitive information, potentially including CSRF tokens, user identifiers, or private data stored in third-party contexts. The exposure is constrained to the specific data accessible via the storage APIs exposed to the compromised origin context."
}