CVE-2026-17933 in Chrome
Summary
by MITRE • 07/30/2026
Inappropriate implementation in DOMStorage in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/30/2026
This vulnerability represents a significant security flaw in the DOMStorage implementation within Google Chrome browsers prior to version 151.0.7922.72, where inadequate access controls permitted unauthorized data leakage between different origins. The issue stems from insufficient sandboxing mechanisms that should have prevented cross-origin storage access, creating a pathway for malicious actors to exploit the browser's storage subsystem. The vulnerability manifests when a crafted HTML page attempts to access DOMStorage objects belonging to different origins, bypassing the standard same-origin policy enforcement mechanisms that normally protect user data isolation.
The technical implementation flaw resides in how Chrome handled cross-origin storage requests within its DOMStorage API, specifically failing to properly validate or restrict access to storage objects based on origin boundaries. This type of vulnerability falls under CWE-200, Information Exposure, and more specifically aligns with CWE-352, Cross-Site Request Forgery, though the implementation is more accurately characterized as a privilege escalation in storage access controls. The attack vector involves a remote malicious website loading a specially crafted HTML page that attempts to enumerate or extract data from DOMStorage objects of other origins, effectively enabling information disclosure attacks.
The operational impact of this vulnerability extends beyond simple data leakage, potentially allowing attackers to gather sensitive user information including session tokens, authentication data, personal preferences, and other stored application state information. When combined with other browser-based attacks, this vulnerability could facilitate more sophisticated exploitation chains where attackers first gather cross-origin storage data through this vulnerability before using it in subsequent attacks such as session hijacking or credential theft. The low severity classification from Chromium security team does not diminish the potential for abuse in targeted attack scenarios, particularly when combined with other vulnerabilities present in the browser environment.
Mitigation strategies should focus on immediate browser updates to versions 151.0.7922.72 or later where the vulnerability has been patched through enhanced origin validation and stricter DOMStorage access controls. Organizations should also implement network-level protections such as content security policies that limit storage access from untrusted domains, though these measures provide only partial defense given the nature of the vulnerability. Additionally, users should be educated about the importance of keeping browsers updated and avoiding untrusted websites that may attempt to exploit such vulnerabilities. The fix implemented by Google likely involved strengthening the same-origin policy enforcement within the DOMStorage subsystem and ensuring proper validation of cross-origin access attempts through mechanisms aligned with the browser's security architecture principles.
This vulnerability demonstrates the critical importance of proper storage isolation in web browsers, as DOMStorage is a fundamental component that applications use to persistently store data locally. The attack scenario requires only a remote webpage to be loaded, making it particularly dangerous in phishing campaigns or compromised websites where users might unknowingly trigger the exploit. Security practitioners should monitor for indicators of compromise related to this vulnerability and ensure comprehensive browser patch management across all endpoints. The incident underscores the ongoing challenge of maintaining secure web application environments where seemingly minor implementation flaws in core browser components can lead to significant information disclosure risks.
The technical nature of this vulnerability also highlights the complexity of modern browser security models where multiple layers of protection must work in concert to prevent cross-origin data leakage. The fix would have required modifications to Chrome's security architecture to properly enforce storage boundaries, potentially involving changes to how the browser handles storage requests at the kernel level and ensuring that all storage access operations are properly validated against origin policies. This type of vulnerability serves as a reminder that even fundamental web platform features like DOMStorage require rigorous security testing and validation to prevent abuse in real-world scenarios where users interact with untrusted content.