CVE-2026-11255: Chrome Storage Access API Data Leak – Patch to 149.0.7827.53

Technical summary

CVE-2026-11255 involves insufficient input validation (CWE-20) in the Storage Access API within Google Chrome prior to version 149.0.7827.53. The vulnerability allows a remote attacker with a compromised renderer process to exfiltrate cross-origin data through a maliciously crafted HTML page. The Storage Access API is designed to mediate third-party cookie access in privacy-focused browser configurations; weak validation of untrusted input in this API creates a means to bypass intended access controls. Exploitation requires prior renderer process compromise, making this a post-compromise disclosure vulnerability.

Business impact

Organizations that standardize on Chrome for internal or customer-facing use face a data confidentiality risk if their systems are already targeted by an attacker with the capability to compromise the renderer process. The ability to leak cross-origin data could expose sensitive information from banking, email, or SaaS platforms. While the vulnerability requires a prior successful compromise, the ease of exploitation once that foothold exists (no user interaction required) elevates the risk for high-value targets. Patch deployment must be prioritized to close the exfiltration vector, particularly in environments where browser-based work involves sensitive data.

Affected systems

Google Chrome versions prior to 149.0.7827.53 are directly vulnerable. The vulnerability's impact is platform-independent because it resides in Chrome's browser engine; however, the affected vendor list includes Apple macOS, Linux, and Microsoft Windows, reflecting the operating systems on which Chrome runs. Organizations should verify their Chrome deployment version and confirm patch availability for their OS distribution.

Exploitability

Exploitation requires two conditions: (1) the renderer process must already be compromised by an attacker, and (2) the attacker must serve a crafted HTML page to the compromised browser. Once both conditions are met, no user interaction is needed to trigger the leak (the network access vector is unauthenticated, low complexity). This is a high-impact post-compromise scenario—not a zero-click worm—but the low barrier to exploitation after the renderer is compromised makes it attractive to sophisticated adversaries already inside the network.

Remediation

Update Google Chrome to version 149.0.7827.53 or later on all affected systems. Verify the update through Chrome's built-in update mechanism (Settings > About Chrome) and confirm the version number post-reboot. Organizations managing Chrome deployments via mobile device management (MDM) or group policy should queue this update for immediate rollout. No workarounds or configuration changes are available; patching is the only remediation.

Patch guidance

Google Chrome updates are delivered automatically via the browser's updater; users should allow automatic restart when prompted. For managed deployments, push the update through your MDM console or enterprise Chrome management tools. Verify successful patching by checking chrome://version/ across a sample of endpoints. Consider a mandatory restart cycle within 24–48 hours of patch availability to reduce the window where the vulnerability remains exploitable. Third-party applications embedding Chromium or using the Chrome API surface (such as Electron-based apps) may also require updates; consult vendor advisories for those products.

Detection guidance

Detection at the network level is limited because exploitation occurs in-browser within an already-compromised renderer process. Focus detection efforts on: (1) monitoring for unexpected renderer crashes or instability patterns that may precede or indicate exploitation attempts, (2) endpoint telemetry for unusual cross-origin fetch patterns or Storage API calls that bypass policy, and (3) behavioral signals indicating data exfiltration to unexpected destinations. SIEM teams should correlate Chrome crash logs with outbound data transfers to suspicious hosts. Browser security event logs (if available via your MDM solution) should be reviewed for anomalous Storage Access API activity.

Why prioritize this

Although Chromium rates this as Low severity, the CVSS 3.1 score of 7.5 (HIGH) reflects the real-world confidentiality impact: an attacker with renderer-level access gains unauthenticated, no-interaction exfiltration of cross-origin data. The absence of KEV (Known Exploited Vulnerability) status suggests active exploitation is not yet widespread, but the attack surface is broad because any compromised renderer process becomes an exfiltration tool. Organizations with users accessing sensitive web services (banking, healthcare, SaaS platforms) should prioritize this patch within their normal critical update cycle (1–2 weeks).

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) is driven by: Attack Vector (Network) and Attack Complexity (Low) reflecting the remote, low-friction nature of exploitation; Privileges Required (None) and User Interaction (None) reflecting the post-compromise context where the renderer is already under attacker control; Confidentiality Impact (High) reflecting the ability to leak cross-origin data; Integrity and Availability Impact (None) reflecting that this is a disclosure-only flaw. The score appropriately balances the high impact (data exfiltration) against the prerequisite of renderer compromise. Organizations should not discount this as 'just' a post-compromise issue; renderer compromise is a realistic threat in targeted attacks and malware campaigns.

Frequently asked questions