EUVD-2026-40691
GHSA-rc6q-m4xm-xjrm
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Extension delivered over network (AV:N), user must actively install it (UI:R, PR:N), impact limited to partial cross-origin confidentiality leak only (C:L, I:N, A:N).
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Insufficient policy enforcement in Extensions in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinced a user to install a malicious extension to leak cross-origin data via a crafted Chrome Extension. (Chromium security severity: Medium)
AnalysisAI
Cross-origin data leakage in Google Chrome's Extensions subsystem prior to version 150.0.7871.47 allows crafted malicious extensions to bypass same-origin policy enforcement and exfiltrate data from web origins beyond their declared permissions. Exploitation requires convincing a target user to install the malicious extension, making this a social-engineering-dependent attack path rather than a direct network exploit. No active exploitation has been confirmed (absent from CISA KEV), no public proof-of-concept code has been identified, and EPSS at 0.11% (2nd percentile) corroborates negligible observed exploitation activity at time of analysis.
Technical ContextAI
The vulnerability resides in Google Chrome's extension policy enforcement layer, affecting all Chrome versions tracked by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*. The root cause class is CWE-284 (Improper Access Control): Chrome's extension framework permits cross-origin resource access through manifest-declared permissions, but a gap in policy enforcement allows a crafted extension to access data from origins outside its declared scope. This is not a remote code execution primitive - it is a browser security boundary bypass within the extensions sandbox that leaks confidential page content. The EUVD confirms the affected range as Chrome versions below 150.0.7871.47. The SUSE tag in the intelligence metadata suggests downstream Chromium packages in SUSE Linux distributions may also carry the vulnerable code and require separate remediation through distribution package management.
RemediationAI
Upgrade Google Chrome to version 150.0.7871.47 or later, as documented in Google's Stable Channel Update advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Chrome auto-updates by default for consumer installations; enterprise administrators should verify the update has propagated via fleet management tooling and confirm the running version is at or above 150.0.7871.47. For SUSE Linux environments packaging Chromium, monitor SUSE security advisories for downstream patch availability and apply via the standard package manager once available. As a direct compensating control for enterprise environments prior to patching, enforce a Chrome extension allowlist via Google Admin Console enterprise policy - this eliminates the attack vector entirely by preventing installation of unauthorized extensions, though it requires Chrome enterprise management infrastructure and will block unapproved extensions from all users under the policy.
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today