CVE-2026-78896 in Chrome
Summary
by MITRE • 08/26/2026
Information leak in StorageAccessAPI in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Low)
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/26/2026
The vulnerability identified within the Storage Access API of Google Chrome versions preceding 152.0.7977.65 represents a significant breach in browser isolation mechanisms, specifically targeting the cross-origin data access controls that are fundamental to modern web security models. The Storage Access API is designed to manage how third-party cookies and storage partitions interact with first-party contexts, aiming to balance user privacy with legitimate functionality for embedded content such as iframes or widgets. In this specific instance, a flaw in the implementation allowed a remote attacker to bypass these isolation boundaries by crafting a malicious HTML page that exploited improper validation of origin checks during storage access requests. This technical failure effectively neutralized the Same-Origin Policy protections intended to prevent one domain from reading sensitive data belonging to another, thereby enabling unauthorized retrieval of cross-origin information without user consent or knowledge.
From an operational perspective, this vulnerability poses a direct risk to user privacy and data integrity by facilitating cross-site scripting-like outcomes through storage exfiltration rather than script execution. An attacker could leverage this flaw to harvest session tokens, authentication cookies, local storage entries, or other persistent data stored under different origins, potentially leading to account takeover or further lateral movement within an application ecosystem. The severity is classified as low in the Chromium security framework because while the mechanism for exploitation exists, it typically requires user interaction such as visiting a malicious site and may be subject to additional mitigations like browser flags or enterprise policies that restrict third-party storage access by default. Nevertheless, the ability to obtain cross-origin data undermines trust in the browsing environment and can serve as an initial vector for more complex attacks if combined with other vulnerabilities or social engineering tactics.
This flaw aligns closely with CWE-200, which categorizes information exposure issues where sensitive data is accessible without proper authorization controls, and specifically relates to improper restriction of operations within the bounds of a security boundary. In terms of adversary behavior mapping under MITRE ATT&CK, this vulnerability supports techniques associated with Collection from Browser or Exfiltration Over Alternative Protocol if combined with other tools, as it enables the silent gathering of credentials and personal information directly from the client-side storage mechanisms that users assume are secure against cross-domain interference. The lack of strict origin validation in the Storage Access API implementation highlights a gap in how third-party contexts are treated regarding persistent data access, emphasizing the need for rigorous testing of privacy-preserving APIs during browser development cycles to ensure they adhere strictly to established security boundaries.
Mitigation strategies primarily involve updating Google Chrome to version 152.0.7977.65 or later, where these validation checks have been corrected to enforce stricter origin verification before granting storage access permissions. Organizations should also consider implementing Content Security Policy headers that restrict data exfiltration channels and enable third-party cookie blocking by default through browser settings or enterprise management policies to reduce the attack surface for such cross-origin exploits. Regular security audits of web applications using iframes and embedded content are recommended to ensure they do not inadvertently rely on potentially compromised storage mechanisms, while users should maintain up-to-date browsers to benefit from continuous improvements in privacy protections and isolation enforcement within the Chromium engine architecture.