CVE-2026-14155: Chrome StorageAccessAPI Policy Enforcement Flaw Leaks Cross-Origin Data

Technical summary

CVE-2026-14155 exploits insufficient policy enforcement within Chrome's StorageAccessAPI implementation. The StorageAccessAPI is designed to let websites request permission to access third-party cookies and storage—a legitimate privacy control. However, the implementation does not adequately validate or enforce access control boundaries before allowing cross-origin data leakage. An attacker hosting a malicious webpage can leverage this gap to exfiltrate data that should remain isolated to other origins. The vulnerability is classified CWE-284 (Improper Access Control) and carries a CVSS v3.1 score of 6.5 (Medium severity) reflecting the network attack vector, low attack complexity, requirement for user interaction, and high confidentiality impact with no integrity or availability risk.

Business impact

This vulnerability poses a targeted information disclosure risk. Attackers can potentially steal session tokens, authentication credentials, personal identifiers, or other sensitive data stored in browser context. While the attack requires luring a user to a malicious site, the prevalence of phishing, malvertising, and social engineering makes this a realistic threat. Organizations whose employees use Chrome to access sensitive web applications—especially SaaS platforms, email, financial systems, and internal portals—face elevated risk. The confidentiality impact is high but direct service availability and integrity are not compromised, limiting scope to data breach and privacy incidents rather than operational outages.

Affected systems

Google Chrome browsers running version 150.0.7871.46 and earlier are vulnerable. This includes Chrome on Windows, macOS, Linux, Android, and iOS. Organizations with unmanaged or personal device policies, or those lacking mandatory browser updates, face higher exposure. Chrome Enterprises managed through Workspace or similar tooling can enforce rapid patching to mitigate risk more effectively.

Exploitability

Exploitability is moderate. The attack requires crafting a malicious HTML page and socially engineering a user to visit it while authenticated to a target service. No zero-click exploitation is possible; user action is mandatory. However, the attack surface is broad—any webpage visited by a Chrome user becomes a potential launch point. Once a user lands on the malicious page, the exploitation itself is trivial from a technical standpoint, making this a practical concern for targeted attacks against high-value users. No public exploit code is known to exist at publication time, and the vulnerability has not been added to the CISA Known Exploited Vulnerabilities catalog.

Remediation

Update Google Chrome to version 150.0.7871.47 or later. For Chrome Enterprise customers, deploy this build through your MDM or update management system with priority. For individual users, enable automatic updates (the default setting) to receive the patch automatically. Organizations should verify the update in a test environment if feasible before broad rollout. Additionally, reinforce user awareness training to reduce the likelihood of users navigating to untrusted websites, and consider supplementary protections such as web filtering or browser isolation for high-risk users.

Patch guidance

Google Chrome version 150.0.7871.47 and later includes the fix. Verify the installed version via Chrome's About page (chrome://about) or Settings > About Chrome, which will auto-check for updates. For enterprise deployments, consult Google's official Chrome Enterprise release notes and apply the patch via your standard update channels. No workarounds are available; patching is the only remediation. Test the patch in a controlled environment to confirm compatibility with your internal web applications before organization-wide deployment.

Detection guidance

Monitor for and block access to known malicious domains using web filters or DNS security tools. Implement browser telemetry logging if available within your Chrome Enterprise deployment to identify unusual cross-origin access patterns. Security Information and Event Management (SIEM) systems can correlate suspicious authentication or data exfiltration events with user browser visits to untrusted sites. Endpoint Detection and Response (EDR) tools may flag unusual data movements from browser processes. However, detection of successful exploitation post-compromise is challenging; prevention through patching and user awareness remains the strongest control.

Why prioritize this

This vulnerability merits timely but not emergency remediation. Although the CVSS score is Medium (6.5) and confidentiality impact is high, the requirement for user interaction significantly reduces real-world likelihood compared to remote code execution flaws. Organizations should prioritize patching within 30 days, with faster deployment for users handling highly sensitive data or those in high-risk industries (finance, healthcare, government). The absence of known active exploitation and non-inclusion in the KEV catalog further reduces urgency compared to critical vulnerabilities, but the information disclosure risk should not be deferred.

Risk score, explained

The CVSS 6.5 rating reflects a network-based attack that is relatively easy to execute (low complexity) but requires user action (UI interaction) and does not affect other users (scoped to the user's own data). The primary impact is high confidentiality loss—an attacker can leak cross-origin data the user has access to—with no direct integrity or availability degradation. The Medium severity designation appropriately captures this as a serious but not critical threat requiring prompt attention within normal patching cycles.

Frequently asked questions