Google Chrome’s Storage Access API accepts untrusted input without adequate validation, enabling a remote attacker who has already compromised the renderer process to construct a crafted HTML page that can read and leak cross‑origin data. This flaw falls under CWE‑20 – Improper Input Validation, and its primary consequence is the loss of data confidentiality.

Google Chrome versions prior to 149.0.7827.53 are affected. The vulnerability exists in the Storage Access API implementation in the renderer component.

The CVSS score for this vulnerability is 7.5, which falls into the high severity range. The CVE is rated low in Chromium’s own severity assessment, and exploitability metrics are not publicly disclosed, which suggests limited exploitation likelihood. The flaw requires that the attacker first compromise the renderer process, meaning a successful exploitation path would involve a broader privilege escalation attack. The vulnerability is not listed in CISA’s KEV catalog, further indicating a lower immediate threat. Nonetheless, any compromise that grants renderer access could lead to cross‑origin data leaks, so organizations should evaluate the risk of renderer process exploitation in their environment.