Description

Incorrect authorization in StorageAccessAPI in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-25T21:17:56.207Z",
  "pubdate": "2026-08-25T21:17:56.207Z",
  "executiveSummary": "This vulnerability involves an incorrect authorization flaw within the StorageAccessAPI component of Google Chrome, specifically affecting versions prior to 152.0.7977.65.\nThe flaw permits a remote attacker who has successfully compromised the renderer process to circumvent the browser's fundamental web origin policy.\nBy leveraging this authorization defect, an attacker can perform unauthorized cross-origin operations that would otherwise be restricted by security boundaries.\nThe Chromium project has classified the security severity of this vulnerability as Low.\nSuccessful exploitation requires the attacker to first achieve code execution within the renderer process, typically via a separate chain of exploits targeting memory corruption or similar sandbox escape vectors.\nThe primary risk implication is the degradation of the browser's isolation mechanisms, potentially allowing sensitive data access or unauthorized state manipulation across web origins.\nUsers and administrators are advised to update to version 152.0.7977.65 or later to resolve the underlying authorization logic error.",
  "technicalDetails": "The vulnerability resides within the implementation of the StorageAccessAPI in Chromium-based browsers, which is designed to manage third-party cookie and storage access in restricted environments.\nThe root cause is an incorrect authorization check during the validation of cross-origin requests, where the browser fails to properly verify or enforce origin boundaries when the StorageAccessAPI state is invoked.\nIn a standard Chromium architecture, the renderer process is sandboxed and restricted from accessing data belonging to other origins via the Same-Origin Policy (SOP). The StorageAccessAPI provides a mediated interface for legitimate cross-origin access, but this implementation incorrectly validates the authorization tokens or state associated with specific requests.\nThe attack flow initiates when an attacker gains control of the renderer process through a secondary vulnerability, such as a heap overflow or use-after-free within the rendering engine. Once the renderer is compromised, the attacker can inject malicious script execution contexts.\nBy crafting a specific HTML payload that triggers the StorageAccessAPI, the attacker exploits the flawed authorization logic to bypass the browser's enforcement mechanisms. Because the validation component fails to differentiate between authorized and unauthorized requests correctly, the attacker can force the browser to treat a cross-origin request as privileged.\nThe payload utilizes the API to request elevated storage access; due to the bug, the browser's security logic erroneously grants this access. This allows the attacker to interact with cookies, localStorage, or other origin-bound storage entities of a target domain without the user's consent or proper cross-origin headers.\nThe impact of this post-exploitation behavior includes the potential exfiltration of sensitive session tokens or data cross-origin, effectively neutralizing the isolation provided by the web origin policy. Given that this requires an existing renderer compromise, the exploit represents a significant escalation of privileges within the browser security architecture, despite its 'Low' severity rating."
}