CVE-2026-79060 in Chrome
Summary
by MITRE • 08/26/2026
Incorrect authorization in StorageAccessAPI in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/26/2026
The vulnerability identified as an incorrect authorization flaw within the StorageAccessAPI of Google Chrome prior to version 152.0.7977.65 represents a significant breach in browser-based isolation mechanisms. This specific issue stems from a logic error where the API fails to properly validate or enforce access controls when handling storage permissions across different web origins. The core technical flaw lies in the insufficient separation of state between distinct browsing contexts, allowing data intended for one origin to be accessible by another under certain conditions. This misconfiguration undermines the fundamental security model that relies on strict origin boundaries to prevent unauthorized data exfiltration and cross-site scripting attacks.
The operational impact is particularly severe when considering an attacker who has already achieved code execution within a renderer process through other means, such as exploiting a separate vulnerability in JavaScript engine or web content rendering components. By leveraging this authorization bypass, the compromised renderer can craft HTML pages that trick the browser into granting access to storage resources belonging to different origins. This effectively neutralizes the Same-Origin Policy, which is designed to restrict how documents or scripts loaded from one origin interact with resources from another origin. Consequently, an attacker could potentially read sensitive user data stored in cookies, local storage, or indexedDB databases that belong to other websites visited by the same browser profile.
From a classification perspective, this vulnerability aligns closely with CWE-269, which denotes Improper Authorization, specifically regarding privilege escalation within application logic rather than system-level privileges. It also maps to MITRE ATT&CK techniques related to Data from Local System or Cross-Site Request Forgery mechanisms where the attacker abuses legitimate API functions for unauthorized data access. The severity is rated as low by Chromium security standards because it requires a pre-existing compromise of the renderer process, meaning it cannot be exploited directly via a simple web page visit without prior exploitation steps. However, its existence facilitates lateral movement and deeper system penetration once initial access is gained.
Mitigation strategies primarily involve upgrading to Google Chrome version 152.0.7977.65 or later, where the StorageAccessAPI logic has been corrected to enforce stricter origin checks before granting storage access. For organizations unable to update immediately due to compatibility concerns, implementing strict Content Security Policy headers can help mitigate some downstream effects by restricting script execution contexts and reducing the attack surface for renderer compromises. Additionally, enabling site isolation features ensures that different origins are rendered in separate processes, thereby limiting the blast radius of any single renderer compromise and making it significantly harder for an attacker to leverage this specific API flaw across multiple sites.