EUVD-2026-40645
GHSA-cwg6-g6fr-j834
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
AC:H reflects the dual prerequisite of malicious extension installation plus crafted page delivery; UI:R captures mandatory active user participation; C:L/I:L reflects UXSS cross-origin script injection with no availability impact.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Incorrect security UI in Extensions in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinced a user to install a malicious extension to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Incorrect security UI in Google Chrome's Extensions subsystem prior to version 150.0.7871.47 enables Universal Cross-Site Scripting (UXSS), allowing script or HTML injection across web origins via a crafted HTML page. Exploitation requires that the victim user be socially engineered into installing a malicious extension, after which a crafted page triggers the CWE-79 flaw in the Extensions UI. No public exploit exists at time of analysis, EPSS sits at the 4th percentile, and CISA has not listed this in KEV, consistent with the SSVC exploitation:none assessment.
Technical ContextAI
The vulnerability exists in Google Chrome's Extensions subsystem UI, specifically in how security-relevant content is rendered or displayed during extension interactions. CWE-79 (Improper Neutralization of Input During Web Page Generation) identifies the root cause as insufficient sanitization or escaping of attacker-controlled content within the browser's Extensions security UI layer. UXSS (Universal Cross-Site Scripting) is a browser-level attack class distinct from standard reflected or stored XSS: rather than exploiting a flaw in a specific web application, it exploits the browser itself to bypass the Same-Origin Policy, enabling injected scripts to operate across any origin the victim visits. The CVSS vector AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N captures a network-delivered attack requiring user interaction but no privileges. Affected versions are confirmed via EUVD-2026-40645 as all Chrome releases below 150.0.7871.47.
RemediationAI
The primary fix is to update Google Chrome to version 150.0.7871.47 or later, which contains the vendor-released patch as documented in the stable channel advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Chrome's built-in auto-update mechanism handles this for most consumer and enterprise deployments automatically. As a compensating control, enterprise administrators should enforce extension installation allowlists via the Google Admin Console (Chrome Enterprise policies: ExtensionInstallAllowlist / ExtensionInstallBlocklist), which directly neutralizes the social engineering prerequisite this vulnerability depends on; the trade-off is potential friction for users who legitimately install extensions from outside the corporate allowlist. Disabling or restricting sideloading of unpacked extensions (via DeveloperToolsDisabled or ExtensionInstallSources policies) further reduces the attack surface at the cost of developer workflow flexibility.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today