CVE-2026-78896: Google Chrome Information Disclosure Vulnerability

CVE-2026-78896 Overview

CVE-2026-78896 is an information disclosure vulnerability in the StorageAccessAPI component of Google Chrome versions prior to 152.0.7977.65. A remote attacker can obtain cross-origin data by tricking a user into visiting a crafted HTML page. The flaw is categorized under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. Chromium rates the internal security severity as Low. Exploitation requires user interaction, such as loading a malicious page, but does not require authentication or elevated privileges.

Critical Impact
A successful attack breaks the same-origin boundary enforced by StorageAccessAPI, allowing an attacker-controlled origin to read data belonging to another origin.

Affected Products

Google Chrome for Desktop prior to 152.0.7977.65
Chromium-based browsers that inherit the vulnerable StorageAccessAPI implementation
Downstream distributions bundling Chromium builds earlier than 152.0.7977.65

Discovery Timeline

2026-08-25 - CVE-2026-78896 published to the National Vulnerability Database
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-78896

Vulnerability Analysis

The StorageAccessAPI allows embedded third-party contexts to request access to their own first-party storage under user control. It is designed to enforce strict origin isolation when granting or denying access. In vulnerable Chrome builds, the API leaks information tied to origins other than the requesting origin. An attacker hosting a crafted HTML page can read data that should remain isolated by the same-origin policy.

The disclosure is limited in scope: confidentiality impact is partial, and there is no direct impact to integrity or availability. However, cross-origin data leakage can expose session identifiers, personalization state, or tracking artifacts that support follow-on attacks such as account takeover or user deanonymization.

Root Cause

The root cause is improper enforcement of origin boundaries within the StorageAccessAPI code path. The component fails to consistently isolate storage metadata or access decisions between the requesting origin and unrelated origins. This corresponds to [CWE-200], where a component exposes information to an actor not explicitly authorized to receive it. Google's advisory does not disclose the specific code path; the fix is shipped in the Stable Channel update referenced in Chromium Issue Tracker #519229463.

Attack Vector

Exploitation is network-based and requires user interaction. An attacker hosts a crafted HTML page and lures a target using the vulnerable Chrome build to visit it. The page invokes StorageAccessAPI methods in a manner that causes the browser to return or reveal cross-origin data. No authentication, prior compromise, or local access is required. See the Google Chrome Stable Update advisory for the vendor's release notes covering this issue.

Detection Methods for CVE-2026-78896

Indicators of Compromise

Chrome browser processes running versions earlier than 152.0.7977.65 in enterprise inventory scans.
Outbound requests from user endpoints to unfamiliar domains hosting HTML pages that invoke document.requestStorageAccess() or related APIs in unusual patterns.
Browser telemetry showing cross-origin storage access grants that do not correlate with expected user workflow.

Detection Strategies

Inventory installed browser versions across managed endpoints and flag any Chrome or Chromium-based build earlier than 152.0.7977.65.
Correlate web proxy logs with threat intelligence feeds for domains delivering exploit content targeting Chromium browsers.
Monitor endpoint DNS and HTTP telemetry for repeated visits to newly registered domains hosting scripted StorageAccessAPI calls.

Monitoring Recommendations

Enforce Chrome auto-update policies and alert on endpoints that fail to update within a defined SLA.
Ingest browser and proxy logs into a centralized data lake to support cross-source hunting for anomalous cross-origin activity.
Track Google Chrome release notes and Chromium issue tracker updates for further guidance tied to StorageAccessAPI.

How to Mitigate CVE-2026-78896

Immediate Actions Required

Update Google Chrome to version 152.0.7977.65 or later on all managed endpoints.
Restart browser processes after update to ensure the patched binary is loaded.
Verify that Chromium-based browsers such as Edge, Brave, and Opera have applied the corresponding upstream Chromium fix.

Patch Information

Google addressed CVE-2026-78896 in the Chrome Stable Channel release documented in the Google Chrome Stable Update advisory. The fixed version is 152.0.7977.65. Administrators should confirm deployment through group policy, MDM, or endpoint management tooling. Additional technical detail is tracked in Chromium Issue Tracker #519229463.

Workarounds

Restrict browsing to trusted sites via enterprise URL filtering until patch deployment completes.
Disable third-party storage access prompts through Chrome enterprise policy where business workflows permit.
Enforce strict Referrer-Policy and Cross-Origin-Opener-Policy headers on internal applications to reduce cross-origin exposure.

bash

# Verify Chrome version on Linux/macOS endpoints
google-chrome --version

# Windows registry check for installed Chrome version
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv