EUVD-2026-40768
GHSA-727w-cq94-9wj2
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Network delivery via extension install, no attacker privileges needed, but active user interaction (UI:R) is mandatory; only confidentiality is impacted via memory read.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Insufficient policy enforcement in DevTools in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinced a user to install a malicious extension to obtain potentially sensitive information from process memory via a crafted Chrome Extension. (Chromium security severity: Low)
AnalysisAI
Insufficient policy enforcement in Chrome's DevTools component allows a crafted malicious extension to read potentially sensitive data from process memory. Affected versions are all Google Chrome releases prior to 150.0.7871.47 on desktop platforms. An attacker must first persuade a victim to install the malicious extension, after which the extension can silently extract in-memory data - including session tokens, credentials, or page content resident in the Chrome process - without triggering further user interaction. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Technical ContextAI
The vulnerability resides in Chrome's DevTools subsystem, which exposes privileged inspection APIs to extensions under a policy enforcement model. CWE-602 (Client-Side Enforcement of Server-Side Security) identifies the root cause: the browser relies on client-side policy checks within the DevTools layer to restrict what an extension can introspect, but those checks are insufficiently enforced, allowing a crafted extension to bypass them. The affected component mediates access between the Chrome Extension API surface and lower-level process internals; a compliant extension should be sandboxed from arbitrary process memory, but the policy gap breaks this boundary. The Chromium security team rated this Low severity internally, likely reflecting the social-engineering prerequisite, though NVD's CVSS 6.5 and the C:H impact metric reflect the potential sensitivity of in-memory data exposed if exploitation succeeds.
RemediationAI
Update Google Chrome to version 150.0.7871.47 or later, which contains the vendor-released patch per the Google Chrome Stable Channel advisory at chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Chrome's built-in auto-update mechanism will deliver this for most users; verify the installed version via chrome://settings/help. As a compensating control where immediate patching is not feasible, enforce extension allowlisting via enterprise policy (ExtensionInstallAllowlist / ExtensionInstallBlocklist) to prevent installation of unapproved extensions - this directly removes the delivery vector and eliminates the exploitation condition. The trade-off is that allowlisting requires ongoing policy maintenance. Disabling Developer Mode extensions in managed environments via policy (DeveloperToolsAvailability=2) may reduce the DevTools attack surface but does not constitute a complete fix. No workaround substitutes for patching.
Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today