CVE-2026-11255: Google Chrome Information Disclosure Flaw

CVE-2026-11255 Overview

CVE-2026-11255 is an input validation vulnerability [CWE-20] affecting the Storage Access API in Google Chrome prior to version 149.0.7827.53. The flaw allows a remote attacker who has already compromised the renderer process to leak cross-origin data using a crafted HTML page. Google has assigned the issue a Chromium security severity of Low, while NVD scores it 7.5 using CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. The vulnerability impacts Chrome on Windows, macOS, and Linux platforms.

Critical Impact
Successful exploitation breaks the same-origin policy boundary enforced by the Storage Access API, exposing cross-origin data to an attacker controlling the renderer process.

Affected Products

Google Chrome prior to 149.0.7827.53
Chrome on Microsoft Windows
Chrome on Apple macOS and Linux

Discovery Timeline

2026-06-05 - CVE-2026-11255 published to NVD
2026-06-05 - Last updated in NVD database

Technical Details for CVE-2026-11255

Vulnerability Analysis

The Storage Access API allows embedded third-party content to request access to unpartitioned cookies and storage that would otherwise be blocked by browser privacy protections. The API enforces origin checks and user-consent gating to prevent cross-site tracking and data leakage. CVE-2026-11255 stems from insufficient validation of untrusted input passed into this API surface.

An attacker who has first compromised the Chrome renderer process can craft an HTML page that submits malformed or unexpected input to Storage Access API calls. The browser fails to validate this input correctly, which allows the attacker to read data belonging to a different origin. Because the renderer is already considered untrusted in Chrome's site-isolation model, the bug undermines a boundary that the browser process is supposed to enforce.

The issue is categorized under [CWE-20: Improper Input Validation]. EPSS data places the probability of exploitation in the next 30 days at 0.048%.

Root Cause

The root cause is missing or incomplete input validation within the Storage Access API implementation in Chromium. Parameters supplied from the renderer are trusted past the point where origin and structural checks should occur, allowing crafted values to influence which origin's data is returned.

Attack Vector

Exploitation requires two stages. The attacker must first compromise the renderer process through a separate flaw or a malicious site rendered in a sandboxed context. The attacker then serves a crafted HTML page that invokes the Storage Access API with input designed to trigger the validation gap, returning cross-origin data into attacker-controlled JavaScript. No user interaction or elevated privileges are required beyond visiting the page in a vulnerable Chrome build. See the Chromium Issue Tracker Entry for technical details.

Detection Methods for CVE-2026-11255

Indicators of Compromise

Chrome browser processes reporting versions below 149.0.7827.53 in endpoint inventory data.
Renderer processes making anomalous Storage Access API requests followed by outbound network traffic to attacker-controlled domains.
HTML pages containing obfuscated JavaScript that repeatedly invokes document.requestStorageAccess() against unrelated origins.

Detection Strategies

Inventory Chrome installations across the fleet and flag any host running a build prior to 149.0.7827.53.
Correlate browser process telemetry with proxy or DNS logs to surface visits to low-reputation pages combined with renderer crashes or sandbox escapes.
Hunt for child process anomalies spawned from chrome.exe shortly after navigation to untrusted domains.

Monitoring Recommendations

Track Chrome version compliance using endpoint management telemetry and patch reporting.
Monitor proxy logs for repeated cross-origin storage requests originating from a single tab session.
Alert on Chrome renderer process exceptions paired with outbound data transfers exceeding baseline.

How to Mitigate CVE-2026-11255

Immediate Actions Required

Update Chrome to version 149.0.7827.53 or later on all Windows, macOS, and Linux endpoints.
Force a managed-browser restart so the patched binary is loaded into memory.
Verify that auto-update is enabled and not blocked by group policy or network egress rules.

Patch Information

Google addressed CVE-2026-11255 in the Stable Channel update for desktop announced on the Chrome Releases blog. The fix ships in Chrome 149.0.7827.53 for Windows, macOS, and Linux. Refer to the Google Chrome Release Update for the full advisory and channel details.

Workarounds

Restrict browsing to trusted sites using enterprise URL allowlists until patching completes.
Enforce site isolation and strict third-party cookie blocking via Chrome enterprise policy to reduce the attack surface of the Storage Access API.
Deploy network egress filtering to limit data exfiltration paths from browser hosts.

bash

# Verify installed Chrome version on Windows, macOS, and Linux
# Windows (PowerShell)
(Get-Item "C:\Program Files\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion

# macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Linux
google-chrome --version

# Expected output: Google Chrome 149.0.7827.53 or later