EUVD-2026-34540
GHSA-3gfh-6wg3-9q56
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAttacker crafts malicious Chrome extension
-
DeliverySocial-engineer user to install extension
-
ExploitExtension invokes DevTools policy bypass
-
ExecutionEscalate privileges within Chrome
-
ImpactAccess cross-origin data or sensitive APIs
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V4 - API and Web Service Server-side security enforcement
|
| Exploitation Conditions | The user must be persuaded to install a specifically crafted malicious Chrome extension (UI:R in the CVSS vector reflects this), and that extension must invoke the vulnerable DevTools policy-enforcement path. Limiting factors: enterprise extension allowlists, the Chrome Web Store review process, and any DeveloperToolsAvailability policy restrictions all reduce the realistic attack surface; environments that permit unrestricted extension sideloading or run developer-mode extensions are most exposed. The privilege escalation is bounded to Chrome's internal trust model rather than escaping to the host OS, per the Chromium Medium severity rating. |
| Impact | Signals conflict in informative ways: CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/C:H/I:H/A:H) suggests a serious network-exploitable issue, but the UI:R component and the description's explicit dependence on the user installing a malicious extension make this far less drive-by than the score implies. EPSS at 0.01% (1st percentile) and absence from CISA KEV both align with the Chromium team's own Medium severity rating, indicating low real-world exploitation likelihood. Practically, this is a meaningful defense-in-depth fix rather than an emergency patch - risk is concentrated in environments where users sideload unvetted extensions or where managed extension policies are weak. Note: CVSS PR:N is somewhat misleading here because while no Chrome authentication is needed, social engineering to install an extension is effectively a prerequisite that CVSS does not cleanly model. |
| Exploit ScenarioDerived | An attacker publishes a benign-looking Chrome extension (productivity tool, theme, ad-blocker clone) to the Web Store or distributes it via a phishing landing page, convincing a target user to install it. Once installed, the extension uses the crafted DevTools interaction to bypass the normal extension permission boundary and gain elevated privileges within Chrome - enabling actions such as accessing other origins' data, manipulating arbitrary tabs, or capturing credentials beyond what its declared manifest permitted. No public exploit identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 05, 2026
Privilege escalation in Google Chrome DevTools versions prior to 149.0.7827.53 allows attackers to abuse insufficient policy enforcement through a malicious browser extension. The flaw requires user interaction to install a crafted extension, after which the attacker can gain elevated privileges within the browser context. No public exploit identified at time of analysis, and EPSS scoring (0.01%) indicates very low near-term exploitation probability despite the high CVSS rating.
RemediationAI
Vendor-released patch: Google Chrome 149.0.7827.53 - upgrade Chrome desktop installations to this version or later via the Stable channel update at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html and restart the browser to apply. In managed environments, accelerate distribution via Chrome Browser Cloud Management or your existing software-deployment tooling, and verify Chromium-based browser vendors (Edge, Brave, Opera) have rebased onto a patched Chromium build before considering them safe. As compensating controls until patching completes, enforce ExtensionInstallAllowlist / ExtensionInstallBlocklist enterprise policies to prevent installation of unvetted extensions, and consider DeveloperToolsAvailability=DeveloperToolsDisallowed for high-risk user populations - note this breaks legitimate web-developer workflows and should be scoped accordingly. The chromium issue tracker entry (https://issues.chromium.org/issues/500170887) is referenced but typically remains restricted until well after public disclosure.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in Chrome's DevTools subsystem, which exposes powerful debugging and inspection capabilities (DOM access, network interception, JavaScript execution) that normally require explicit user consent. CWE-602 (Client-Side Enforcement of Server-Side Security) indicates the policy boundary intended to restrict extension capabilities against DevTools was enforced incorrectly, allowing a crafted extension to bypass the trust boundary between extension sandbox and privileged DevTools APIs. Chromium classifies the underlying severity as Medium, suggesting the escalation is bounded within the browser rather than achieving OS-level code execution. CPE data was not provided, but EUVD identifies affected scope as Chrome builds below 149.0.7827.53.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Insufficient policy enforcement in DevTools in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a malicious extension to perform privilege escalation via a crafted Chrome Extension. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome DevTools versions prior to 149.0.7827.53 contain a privilege escalation vulnerability exploitable through malicious browser extensions, affecting all Chrome deployments in the organization. The 0.01% exploitation probability and user-interaction requirement provide short-term assurance, but the high CVSS score (8.8) and elevation potential justify immediate patch prioritization to eliminate this attack surface.
Apply vendor patch. Until patched: restrict extension installations to pre-approved lists, require administrative approval for extension additions, disable user permission to install extensions, and conduct user training on extension security risks.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Same technique Privilege Escalation
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB