CVE-2026-14156: StorageAccessAPI Same-Origin Policy Bypass in Chrome

Technical summary

CVE-2026-14156 stems from insufficient policy enforcement in StorageAccessAPI, a Chrome feature that manages cross-site storage access. The vulnerability allows a compromised renderer process to circumvent same-origin policy restrictions (CWE-284: Improper Access Control to Resource, CWE-862: Missing Authorization). An attacker who has already gained execution within the renderer—through an earlier vulnerability or exploit—could craft an HTML page that tricks the policy enforcement mechanism, enabling unauthorized access to protected data. The attack requires user interaction (clicking a link, visiting a page) but does not require any special privileges or system-level changes.

Business impact

This vulnerability primarily threatens organizations where users visit untrusted or partially-trusted websites. If an attacker combines this flaw with a separate renderer-process exploit, they could escalate a localized browser compromise into unauthorized access to sensitive stored data (cookies, local storage, IndexedDB) from other origins. Financial services, healthcare providers, and enterprises using Chrome as their standard browser face elevated risk of data exfiltration. The requirement for a prior renderer compromise limits the immediate blast radius, but the ability to bypass same-origin policy amplifies the damage of any renderer-level exploit.

Affected systems

Google Chrome versions prior to 150.0.7871.47 are affected. This includes all stable, beta, and development builds released before that version number. Users on Windows, macOS, Linux, Android, and iOS versions of Chrome should patch immediately. Chrome OS devices are similarly affected. Organizations standardizing on Chrome across their endpoint fleet should prioritize rollout of version 150.0.7871.47 or later.

Exploitability

Exploitation requires two key conditions: (1) the renderer process must already be compromised by an attacker (via a separate vulnerability), and (2) the user must interact with a maliciously crafted webpage. This is not a remote code execution vulnerability on its own. The vulnerability does not appear on CISA's Known Exploited Vulnerabilities (KEV) catalog, suggesting no widespread active exploitation has been documented as of the publication date. However, the relatively low Chromium severity rating and the CVSS 6.5 MEDIUM score reflect the prerequisite of prior renderer compromise; once that condition is met, exploitation is straightforward.

Remediation

Update Google Chrome to version 150.0.7871.47 or later. Most modern Chrome installations update automatically in the background, but users should verify their current version (chrome://version) and restart the browser to ensure the patch is applied. Enterprise deployments should use group policies or mobile device management (MDM) to enforce the update across their fleet. No workarounds are available; patching is the only mitigation.

Patch guidance

Apply Chrome version 150.0.7871.47 or later. Verify the update by navigating to chrome://version in the address bar; the version number should be 150.0.7871.47 or higher. Restart the browser after updating to ensure the patch takes effect. For enterprises, configure automatic updates via group policy (Windows) or MDM policies (mobile) to eliminate delays. Test compatibility with critical web applications before rolling out widely, though this patch addresses a security boundary issue and should not cause compatibility regressions.

Detection guidance

Monitor Chrome version compliance across your fleet using endpoint management tools or security information and event management (SIEM) systems. Look for devices still running versions below 150.0.7871.47. Watch for unusual cross-origin data access patterns in application logs if you suspect a compromise—though detection at the policy-enforcement level is difficult without Chrome's diagnostic logging enabled. Network detection is limited since the attack occurs within the browser; focus on endpoint-level inventory and version tracking. If a renderer compromise is suspected (unusual crashes, unexpected memory usage, or prior exploitation attempts), assume this vulnerability may have been chained into an attack.

Why prioritize this

Although the Chromium severity is rated Low and CVSS is 6.5 MEDIUM, the vulnerability merits timely patching because it enables same-origin policy bypass—a foundational browser security control. Organizations where users access diverse websites should treat this as a standard security update with relatively high priority. The prerequisite of a prior renderer compromise limits the immediate urgency, but the policy-bypass nature makes it a valuable addition to an attacker's toolkit when chained with other exploits. Patch within your normal browser update cadence (typically 1–2 weeks) rather than as an emergency hotfix.

Risk score, explained

CVSS 6.5 MEDIUM reflects: (1) Network attack vector (AV:N) and low complexity (AC:L) with no privileges required (PR:N), making the initial setup accessible, but (2) user interaction required (UI:R) and unchanged scope (S:U), meaning the attack is confined to the user's own origin context once a renderer is compromised, with integrity impact (I:H) but no confidentiality or availability impact. The score appropriately penalizes the prerequisite of a prior renderer compromise while acknowledging the seriousness of bypassing same-origin policy if that condition is met.

Frequently asked questions