Insufficient validation of untrusted input in Storage Access API in Google Chrome prior to 149

CVE-2026-11255 is an input-validation flaw in Chrome's Storage Access API affecting Google Chrome versions prior to 149.0.7827.53 on desktop release trains. The Storage Access API governs when embedded cross-site content can regain access to unpartitioned third-party cookies and related state, so a bug here is about privacy and origin-boundary enforcement rather than classic memory corruption or direct RCE.

The vendor's HIGH 7.5 score overstates enterprise urgency if the user-supplied description is accurate that exploitation requires an attacker who has already compromised the renderer process. That prerequisite changes the problem from 'internet-scale unauthenticated browser bug' into a post-compromise chain step for cross-site data access. Chrome is everywhere, so you still patch it, but this is not the item that should jump ahead of KEV-listed initial-access bugs or stand-alone Chrome RCEs.

Why this verdict

• Start at vendor 7.5, then cut for prior compromise: requiring a renderer foothold means the attacker has already won an earlier exploit stage, which is major downward pressure on real-world severity.
• Client-side and non-scannable: this is not a perimeter service you can spray from the internet; exploitation requires user browsing context and compatible application state.
• Impact is mostly confidentiality expansion: the bug appears to widen access to protected cross-site storage/session data, but it is not direct OS code execution, privilege escalation, or broad availability impact.

Why not higher?

It is not HIGH because the exploit chain appears to depend on an earlier renderer compromise, which sharply reduces the number of attackers, victims, and sessions that can reach the vulnerable state. There is also no current KEV listing, no active exploitation evidence found, and no public stand-alone PoC pushing this into emergency territory.

Why not lower?

It is not LOW because Chrome is massively deployed and browser-chain bugs can materially increase the value of an existing foothold by exposing SSO or session material. Even without direct RCE, a confidentiality bypass in a common browser can matter on shared workstations, admin browsing profiles, and SaaS-heavy enterprise environments.

1. Enforce browser auto-update compliance — Use endpoint management to verify Chrome is on 149.0.7827.53 or later and close drift as part of normal browser hygiene. For a MEDIUM verdict there is no mitigation SLA — go straight to the 365-day remediation window, but in practice Chrome should be kept on current stable far sooner than that.
2. Reduce high-value browser profiles — Separate privileged admin activity from day-to-day browsing so a renderer foothold plus this bug has less session value to steal. Apply this during the normal remediation cycle; it lowers blast radius even if the patch has not yet landed everywhere.
3. Harden cross-site session design — Favor short-lived tokens, device binding, and reauthentication on sensitive SaaS paths so stolen browser state is less reusable. This is compensating architecture work, not a substitute for updating Chrome.
4. Monitor abnormal IdP and session reuse — Watch for impossible travel, token replay, and new-device session reuse in SSO telemetry because the practical business risk here is session/state theft. Keep this continuously enabled; it helps during and after the remediation window.

Run this on the target endpoint itself, or push it through your RMM/EDR script runner. Invoke with python3 check_chrome_149.py on macOS/Linux or py check_chrome_149.py on Windows; no admin rights are required for standard install paths. The script reports VULNERABLE, PATCHED, or UNKNOWN based on the highest Google Chrome/Chromium version it can find versus 149.0.7827.53.

#!/usr/bin/env python3
# check_chrome_149.py
# Detects whether local Google Chrome / Chromium is below 149.0.7827.53
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN

import os
import platform
import re
import subprocess
import sys
from shutil import which

FIXED = (149, 0, 7827, 53)
VERSION_RE = re.compile(r'(\d+)\.(\d+)\.(\d+)\.(\d+)')


def parse_version(text):
    if not text:
        return None
    m = VERSION_RE.search(text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def ver_to_str(v):
    return '.'.join(str(x) for x in v) if v else 'UNKNOWN'


def run_cmd(cmd):
    try:
        p = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, timeout=8)
        out = (p.stdout or '') + '\n' + (p.stderr or '')
        return out.strip()
    except Exception:
        return ''


def check_binary(path):
    if not path or not os.path.exists(path):
        return None
    out = run_cmd([path, '--version'])
    return parse_version(out)


def windows_candidates():
    paths = []
    envs = ['PROGRAMFILES', 'PROGRAMFILES(X86)', 'LOCALAPPDATA']
    suffixes = [
        r'Google\\Chrome\\Application\\chrome.exe',
        r'Chromium\\Application\\chrome.exe',
    ]
    for env in envs:
        base = os.environ.get(env)
        if base:
            for s in suffixes:
                paths.append(os.path.join(base, *s.split('\\')))
    return paths


def mac_candidates():
    return [
        '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
        '/Applications/Chromium.app/Contents/MacOS/Chromium',
        os.path.expanduser('~/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'),
        os.path.expanduser('~/Applications/Chromium.app/Contents/MacOS/Chromium'),
    ]


def linux_candidates():
    names = [
        'google-chrome', 'google-chrome-stable', 'chromium', 'chromium-browser'
    ]
    paths = []
    for name in names:
        p = which(name)
        if p:
            paths.append(p)
    paths.extend([
        '/usr/bin/google-chrome',
        '/usr/bin/google-chrome-stable',
        '/usr/bin/chromium',
        '/usr/bin/chromium-browser',
        '/snap/bin/chromium',
    ])
    return paths


def collect_versions():
    system = platform.system().lower()
    candidates = []
    if 'windows' in system:
        candidates = windows_candidates()
    elif 'darwin' in system:
        candidates = mac_candidates()
    else:
        candidates = linux_candidates()

    found = []
    seen = set()
    for path in candidates:
        if path in seen:
            continue
        seen.add(path)
        v = check_binary(path)
        if v:
            found.append((path, v))
    return found


def main():
    found = collect_versions()
    if not found:
        print('UNKNOWN: Google Chrome / Chromium not found in standard locations')
        sys.exit(2)

    # Use the highest detected version if multiple builds are present.
    highest_path, highest_ver = max(found, key=lambda x: x[1])

    print(f'Detected: {highest_path} -> {ver_to_str(highest_ver)}')
    print(f'Fixed threshold: {ver_to_str(FIXED)}')

    if highest_ver >= FIXED:
        print('PATCHED')
        sys.exit(0)
    else:
        print('VULNERABLE')
        sys.exit(1)


if __name__ == '__main__':
    main()

Sources

1. Chrome Releases: Early Stable Update for Desktop (149.0.7827.53/.54)
2. Chrome Releases: Chrome Beta for Desktop Update (149.0.7827.53)
3. openSUSE patchinfo: chromium security fixes in 149.0.7827.53
4. MDN: Storage Access API overview
5. Privacy Sandbox Help: How the Storage Access API works
6. CISA Known Exploited Vulnerabilities Catalog
7. FIRST EPSS API documentation