EUVD-2026-34604
GHSA-jjwm-mmf2-4537
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Out of bounds read in Extensions in Google Chrome on Linux prior to 149.0.7827.53 allowed an attacker who convinced a user to install a malicious extension to obtain potentially sensitive information from process memory via a crafted Chrome Extension. (Chromium security severity: Medium)
AnalysisAI
Out-of-bounds heap read in Google Chrome's Extensions component on Linux exposes sensitive process memory to a malicious extension author. Affected versions are Chrome on Linux prior to 149.0.7827.53; Windows and macOS are not listed as affected. Exploitation requires convincing a target user to install a crafted malicious extension, limiting exposure compared to the CVSS 6.5 score implies - no public exploit identified at time of analysis, and EPSS of 0.01% (1st percentile) reflects low current exploitation probability.
Technical ContextAI
The vulnerability is rooted in Chrome's Extensions subsystem on Linux, where heap memory is read beyond its allocated bounds during processing of a crafted extension. A notable discrepancy exists between the description ('out of bounds read') and the assigned CWE-122 ('Heap-based Buffer Overflow') - this may indicate the OOB read is triggered by an underlying heap buffer overflow condition, or may reflect an NVD tagging inconsistency. Chrome extensions run in a sandboxed renderer process but interact with privileged browser APIs; a malformed extension can craft API calls or data structures that cause Chrome's extension handling code to dereference memory outside the intended heap allocation, leaking process memory contents. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) confirms the attack surface is network-reachable through extension delivery but mandates user interaction for installation, and scope is unchanged (the leak stays within the Chrome process boundary).
RemediationAI
Update Google Chrome on Linux to version 149.0.7827.53 or later immediately; this is the vendor-released patch confirmed by the Chrome Releases stable channel advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Chrome typically auto-updates, but administrators should verify the update has applied by checking chrome://settings/help. As a compensating control prior to patching, enforce extension installation policies to allow only vetted, allowlisted extensions via Chrome Enterprise or group policy - this directly addresses the UI:R installation prerequisite that is required for exploitation. Blocking side-loading of unpacked extensions (disabling Developer Mode in Chrome on managed devices) also reduces attack surface. Note: restricting extensions may impact productivity for users who rely on third-party tools, so evaluate scope before applying broadly.
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allVendor StatusVendor
SUSE
| Product | Status |
|---|---|
| openSUSE Tumbleweed | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today