EUVD-2026-40508
GHSA-9wj8-w8j2-m68x
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Social engineering delivers the extension over the network (AV:N); no attacker privileges needed (PR:N); user must install extension (UI:R); only integrity is impacted via SOP bypass (I:H, C:N, A:N).
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Inappropriate implementation in Extensions in Google Chrome on Android prior to 150.0.7871.47 allowed an attacker who convinced a user to install a malicious extension to bypass same origin policy via a crafted Chrome Extension. (Chromium security severity: High)
AnalysisAI
Same-origin policy bypass in Google Chrome's Extensions implementation on Android prior to 150.0.7871.47 enables integrity violations across web origins. An attacker who successfully social-engineers a victim into installing a crafted malicious Chrome extension can exploit an inappropriate implementation in the Extensions subsystem to circumvent SOP controls, potentially modifying cross-origin content or injecting unauthorized actions. No public exploit exists and CISA SSVC assessment confirms no active exploitation; however, the I:H integrity impact and network-accessible delivery path keep this a meaningful patch priority for Android Chrome deployments.
Technical ContextAI
CWE-346 (Origin Validation Error) identifies the root cause: Chrome's Extensions subsystem on Android fails to properly enforce origin checks, allowing extension logic to operate across domain boundaries it should be restricted from. The Same-Origin Policy is a foundational browser security boundary preventing scripts from one origin from reading or manipulating resources from another. When Chrome extensions are granted inappropriate implementation latitude - for instance, improperly handling cross-origin messaging, content script injection scope, or API access - they can cross that boundary. The affected product is identified by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* targeting the Android platform specifically, distinguishing it from desktop Chrome and suggesting the Extensions subsystem has platform-specific implementation differences on Android that introduce the flaw.
RemediationAI
Upgrade Google Chrome on Android to version 150.0.7871.47 or later, which is confirmed as the patched release per the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. On Android, Chrome updates are delivered through the Google Play Store; ensure auto-updates are enabled or manually trigger an update check. As an interim compensating control, organizations managing Android fleets via MDM should enforce extension installation policies that restrict sideloading or restrict extensions to a curated allowlist, directly negating the required attack precondition of installing a malicious extension. Users should be trained not to install Chrome extensions from untrusted sources, particularly outside the Chrome Web Store. Enabling Chrome's Enhanced Safe Browsing on Android may also provide partial signal against known-malicious extension distribution sites, though this does not address the root vulnerability.
Same weakness CWE-346 – Origin Validation Error
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today