CVE-2026-11255: Insufficient validation of untrusted input in Storage Access API in Google Chrome prior to 149

Synopsis

Insufficient input validation in the Storage Access API in Google Chrome prior to version 149.0.7827.53 allows a remote attacker who has already compromised the renderer process to read cross-origin data by serving a crafted HTML page. The vulnerability is reachable over the network with no authentication required and no victim interaction needed beyond browsing, and successful exploitation results in disclosure of data from other origins. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected Chrome version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the target over the network, as the exploit is delivered via a crafted HTML page served remotely.

• AuthenticationNot required

  No account or credentials are needed; the attacker only needs to get the target to load the malicious page.

• Victim interactionNot required

  No user interaction beyond ordinary browsing is required, though the attacker must first have compromised the renderer process.

• Attack complexityDetail

  Attack complexity is rated Low, meaning the exploit is reliable and does not depend on race conditions or specific environmental layout, aside from the prerequisite of a compromised renderer.

Blast Radius

• A successful attacker reads data belonging to other origins that the compromised Chrome renderer would not normally be permitted to access.
• Cross-origin data exposed may include session tokens, authentication cookies, or page content from other sites open in the same browser.
• Integrity and availability of the affected system are not impacted; the exploit is limited to confidentiality loss.