Technical impact
Google Chrome’s Storage Access API accepts untrusted input without adequate validation, enabling a remote attacker who has already compromised the renderer process to construct a crafted HTML page that can read and leak cross‑origin data. This flaw falls under CWE‑20 – Improper Input Validation and CWE‑346 – Inclusion of Private Information in the Output, and its primary consequence is the loss of data confidentiality.
Affected Systems
Google Chrome versions prior to 149.0.7827.53 are affected. The vulnerability exists in the Storage Access API implementation in the renderer component.
Risk and Exploitability
The CVSS score for this vulnerability is 7.5, which falls into the high severity range. The CVE is rated low in Chromium’s own severity assessment, and the EPSS score is less than 1%, indicating a very low exploitation probability. Exploitability metrics are not publicly disclosed, which suggests limited exploitation likelihood. The flaw requires that the attacker first compromise the renderer process, meaning that a successful exploitation path would involve a broader privilege‑scaling attack. The vulnerability is not listed in CISA’s KEV catalog, further indicating a lower immediate threat. Nonetheless, any compromise that grants renderer access could lead to cross‑origin data leaks, so organizations should evaluate the risk of renderer process exploitation in their environment.
Debian DSA