CVE-2026-79005 in Chrome
Summary
by MITRE • 08/26/2026
Incorrect authorization in StorageAccessAPI in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/26/2026
The vulnerability identified as an incorrect authorization flaw within Google Chrome's Storage Access API prior to version 152.0.7977.65 represents a significant breach in the browser's isolation mechanisms, specifically targeting the web origin policy. This security severity is classified as low by Chromium standards, yet it carries substantial implications for privacy and data integrity when exploited in specific contexts. The core of the issue lies in how the Storage Access API handles permissions for third-party cookies and storage access across different origins. When a user interacts with embedded content from one domain within another, the browser must strictly enforce boundaries to prevent unauthorized cross-site tracking or data leakage. In this instance, the authorization logic failed to correctly validate whether the requesting origin had legitimate permission to access specific storage partitions associated with a third-party site.
From a technical perspective, the flaw allows an attacker who has already achieved code execution within the renderer process of Chrome to bypass these strict origin policies. The renderer process is responsible for executing web content and should be heavily sandboxed to prevent it from accessing sensitive browser internals or other tabs' data. However, if an attacker compromises this isolated environment through a separate vulnerability such as a use-after-free or type confusion in JavaScript engine components, they can leverage the flawed Storage Access API logic. By crafting a specific HTML page that triggers incorrect authorization checks, the compromised renderer process can trick the browser into granting access to storage resources belonging to other origins. This effectively neutralizes one of the primary defenses against cross-site scripting and data exfiltration attacks that rely on maintaining strict separation between different web contexts.
The operational impact of this vulnerability is primarily centered around privacy violations and potential session hijacking scenarios, although it requires a pre-existing compromise of the renderer process to be fully effective. This means it cannot be exploited by simply visiting a malicious website; rather, it serves as an escalation path for attackers who have already breached the sandbox boundary. Once inside the renderer, the ability to bypass origin policies allows the attacker to read or write data stored in cookies, local storage, or indexedDB of other sites visited by the user. This could lead to unauthorized access to sensitive information such as authentication tokens, personal preferences, or financial details if those are stored client-side without adequate encryption or separation from session identifiers that might be exposed through this channel.
This vulnerability aligns with CWE-269, which describes Improper Authorization, where a system fails to properly verify the rights of an actor before allowing access to resources. Furthermore, in terms of offensive security frameworks like MITRE ATT&CK, this behavior relates to techniques involving browser-based attacks and privilege escalation within the context of web applications. The exploitation chain typically involves initial compromise via phishing or drive-by downloads leading to renderer process injection, followed by leveraging this specific API flaw to expand the scope of accessible data beyond what was originally intended by the security model.
Mitigation for this issue is primarily achieved through software updates provided by Google Chrome developers. Users and organizations should ensure that their browsers are updated to version 152.0.7977.65 or later, where these authorization checks have been corrected to strictly enforce origin boundaries regardless of the calling context within the renderer process. Additionally, defense-in-depth strategies such as enabling strict Content Security Policies (CSP) can help mitigate some downstream effects by restricting how scripts interact with storage APIs. Regular security audits and penetration testing that include browser sandbox escape simulations are recommended for high-security environments to detect any potential exploitation attempts or related vulnerabilities in adjacent components of the browser architecture.