EUVD-2026-37541Severity by source
Sources disagree (Medium–Critical)AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
Extension distributed over network (AV:N); social engineering to install drives AC:H and UI:R; SOP bypass yields limited cross-origin read/write with no availability impact.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
Lifecycle Timeline
3DescriptionCVE.org
Inappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.155 allowed an attacker who convinced a user to install a malicious extension to bypass same origin policy via a crafted Chrome Extension. (Chromium security severity: High)
AnalysisAI
Same-origin policy bypass in Google Chrome's Extensions subsystem prior to version 149.0.7827.155 allows an attacker to read or modify cross-origin web content after convincing a target user to install a crafted malicious extension. The attack is network-delivered but hinges entirely on social engineering the victim into extension installation, reflected in the CVSS AC:H and UI:R ratings and SSVC's 'Automatable: no' determination. No active exploitation has been identified at time of analysis; EPSS probability is 0.18% (8th percentile), consistent with SSVC's 'Exploitation: none' assessment.
Technical ContextAI
The vulnerability is rooted in CWE-20 (Improper Input Validation) within Chrome's Extensions subsystem, where the browser's same-origin policy - the foundational security boundary preventing cross-origin content access - is incorrectly enforced when certain extension behaviors are triggered. Chrome extensions operate with elevated access to privileged browser APIs (content scripts, chrome.* API surface, cross-origin XMLHttpRequest permissions), and a flaw in how Chrome validates origin boundaries within this subsystem enables a crafted extension to bypass SOP constraints. The affected component spans all Google Chrome releases prior to 149.0.7827.155 per CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*. Red Hat and SUSE tags suggest downstream Chromium-based packages in Linux distributions are also implicated, requiring separate vendor patch cycles.
RemediationAI
Update Google Chrome to version 149.0.7827.155 or later, the vendor-released patch documented at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_01750511403.html. Chrome's automatic update mechanism typically handles this without user action; verify the installed version by navigating to chrome://settings/help and confirming 149.0.7827.155 or higher is shown. For enterprise environments, enforce extension allowlisting via Google Admin Console or Group Policy to restrict installation to explicitly approved extensions - this directly eliminates the exploitation prerequisite with manageable usability trade-offs limited to blocking unapproved extensions. Disabling extensions entirely via policy removes all attack surface but significantly impacts browser utility. Red Hat and SUSE administrators should monitor their respective package repositories for updated Chromium builds, as the upstream Chrome patch may not yet be reflected in distribution packages.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today