CVE-2026-14155: Google Chrome Information Disclosure Flaw

CVE-2026-14155 Overview

CVE-2026-14155 is a medium-severity vulnerability in Google Chrome caused by insufficient policy enforcement in the StorageAccessAPI component. The flaw affects Chrome versions prior to 150.0.7871.47. A remote attacker can leak cross-origin data by convincing a user to visit a crafted HTML page. The issue falls under [CWE-284: Improper Access Control] and was addressed in the Chrome Stable channel update. Chromium engineers rated the underlying security severity as Low, while the CVSS 3.1 base score is 6.5.

Critical Impact
Successful exploitation exposes confidential cross-origin data, undermining the Same-Origin Policy that isolates websites in the browser.

Affected Products

Google Chrome versions prior to 150.0.7871.47
Chromium-based browsers using the vulnerable StorageAccessAPI implementation
Desktop Stable channel builds on Windows, macOS, and Linux

Discovery Timeline

2026-06-30 - CVE-2026-14155 published to NVD
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-14155

Vulnerability Analysis

The vulnerability resides in Chrome's implementation of the Storage Access API. This API allows embedded third-party content to request access to unpartitioned cookies and storage under controlled conditions. Insufficient policy enforcement means the browser fails to correctly validate origin boundaries before granting or exposing storage-scoped data. As a result, a malicious page can obtain information that belongs to a different origin, breaking the browser's Same-Origin Policy guarantees.

The issue is classified under [CWE-284] (Improper Access Control). The attack requires user interaction, typically the act of visiting an attacker-controlled webpage. No elevated privileges or authentication are required to trigger the condition.

Root Cause

The root cause is inadequate enforcement of cross-origin access policy within the StorageAccessAPI code path. The component does not consistently verify the requesting origin's authorization state before returning storage handles or associated data. This logic gap allows a remote origin to observe data that should be partitioned away from it.

Attack Vector

Exploitation is network-based and requires user interaction. An attacker hosts a crafted HTML page and lures a victim into loading it in a vulnerable Chrome build. The page issues Storage Access API calls that bypass the intended origin checks, extracting cross-origin data. Confidentiality impact is high, while integrity and availability are not affected. There are no public proof-of-concept exploits, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The current EPSS probability is 0.186%.

See the Chromium Issue Tracker #518246925 for additional technical context.

Detection Methods for CVE-2026-14155

Indicators of Compromise

Chrome browser processes running versions earlier than 150.0.7871.47 in enterprise inventories
Outbound web requests to unfamiliar domains hosting HTML pages that invoke document.requestStorageAccess() in unusual patterns
Browser telemetry showing repeated Storage Access API prompts from third-party iframes on untrusted sites

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag any build below 150.0.7871.47 for prioritized patching.
Correlate browser process telemetry with proxy or DNS logs to identify sessions where users visited newly registered or low-reputation domains before anomalous cross-origin activity.
Review web filtering logs for pages known to abuse iframe embedding and Storage Access API prompts as a delivery mechanism.

Monitoring Recommendations

Enable browser version reporting through Chrome Enterprise policies and forward the data to a centralized log platform.
Alert on endpoints that remain on unpatched Chrome versions beyond the organization's defined patch window.
Monitor URL categorization feeds for newly observed domains associated with cross-origin data leakage or tracking abuse.

How to Mitigate CVE-2026-14155

Immediate Actions Required

Update Google Chrome to version 150.0.7871.47 or later on all managed endpoints.
Restart browser sessions after deployment to ensure the patched binary is loaded.
Verify enterprise auto-update policies are enabled and functioning to prevent regression to vulnerable builds.

Patch Information

Google released the fix in the Stable channel update announced on the Chrome Releases blog. Administrators managing Chromium-based derivatives should confirm that the corresponding upstream fix has been merged into their distribution.

Workarounds

Restrict access to untrusted websites via enterprise web filtering while patch deployment is in progress.
Disable third-party cookies and cross-site tracking features through Chrome Enterprise policy to reduce exposure of Storage Access API requests.
Educate users to avoid clicking links from unsolicited messages that could lead to attacker-controlled HTML pages.

bash

# Configuration example: enforce minimum Chrome version via Chrome Enterprise policy (Windows registry)
reg add "HKLM\Software\Policies\Google\Chrome" /v MinimumBrowserVersion /t REG_SZ /d "150.0.7871.47" /f
reg add "HKLM\Software\Policies\Google\Chrome" /v BlockThirdPartyCookies /t REG_DWORD /d 1 /f