EUVD-2026-34728
GHSA-93v7-558w-29j5
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Lifecycle Timeline
4DescriptionCVE.org
Insufficient policy enforcement in Extensions in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a malicious extension to bypass content security policy via a crafted Chrome Extension. (Chromium security severity: Low)
AnalysisAI
Content Security Policy bypass in Google Chrome prior to 149.0.7827.53 allows a remote attacker who convinces a victim to install a crafted malicious extension to circumvent CSP protections on web pages, enabling unauthorized content injection. The flaw stems from insufficient policy enforcement in Chrome's Extensions subsystem (CWE-602), rated Low severity by the Chromium security team with a CVSS base score of 4.3. No public exploit code exists and no active exploitation has been confirmed; EPSS is 0.01% (1st percentile), reflecting minimal real-world exploitation pressure at time of analysis.
Technical ContextAI
The vulnerability is rooted in CWE-602 (Client-Side Enforcement of Server-Side Security), meaning Chrome's extension engine incorrectly defers or inadequately enforces Content Security Policy - a browser-side security mechanism that restricts which scripts, styles, and resources a web page may load. Chrome extensions operate with elevated browser-internal privileges and can interact with page contexts in ways ordinary web content cannot; insufficient gating in extension policy enforcement allows a malicious extension to inject or execute content that CSP should have blocked. The affected product is Google Chrome across all desktop platforms prior to version 149.0.7827.53, as identified in the ENISA EUVD entry EUVD-2026-34728 and the Google Chrome Releases advisory.
RemediationAI
Vendor-released patch: Chrome 149.0.7827.53. Users and administrators should update Google Chrome to version 149.0.7827.53 or later via the browser's built-in update mechanism (Help > About Google Chrome) or via enterprise deployment tooling; details are available at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. As a compensating control prior to patching, enterprise administrators can restrict extension installation using Chrome's ExtensionInstallBlocklist and ExtensionInstallAllowlist group policies to prevent installation of untrusted or unreviewed extensions - note this may impact legitimate productivity extensions and requires an allowlist to be maintained. Enforcing the Chrome Web Store review policy and disabling developer mode extensions in managed environments also reduces the attack surface; however, these controls do not address the underlying policy enforcement flaw and should not substitute for patching.
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac
Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, a
The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, do
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13
Same technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Medium| Product | Status |
|---|---|
| openSUSE Tumbleweed | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today