EUVD-2026-41182
GHSA-c7mf-q7g4-27p2
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
UI:R reflects the mandatory user-install step for the malicious extension; AC:H captures the social engineering prerequisite; C:H retained as process memory disclosure applies; no integrity or availability impact.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Out of bounds read in V8 in Google Chrome prior to 150.0.7871.46 allowed an attacker who convinced a user to install a malicious extension to obtain potentially sensitive information from process memory via a crafted Chrome Extension. (Chromium security severity: Medium)
AnalysisAI
Out-of-bounds read in Chrome's V8 JavaScript engine allows a memory disclosure attack against users running Google Chrome prior to 150.0.7871.46. An attacker who socially engineers a victim into installing a crafted malicious extension can trigger the OOB read to leak sensitive data from the renderer process memory, such as tokens or session material. No public exploit code has been identified and SSVC classifies exploitation as none, but the high confidentiality impact and Chrome's global install base make patching the appropriate near-term action.
Technical ContextAI
The vulnerability resides in V8, Chrome's open-source, high-performance JavaScript and WebAssembly engine (CWE-125: Out-of-Bounds Read). V8 manages JavaScript heap allocation and JIT compilation; an out-of-bounds read arises when array or buffer indexing lacks proper bounds validation, permitting memory reads beyond the end of the allocated region. Chrome extensions execute JavaScript inside the renderer process and interact directly with V8 internals, giving a malicious extension the ability to craft JavaScript that triggers this condition and capture adjacent heap contents. The affected product is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering all Chrome stable builds before 150.0.7871.46 as documented in ENISA EUVD-2026-41182. The SUSE tag in the intelligence data indicates downstream Linux distribution packaging (openSUSE/SLES) of Chrome also carries the vulnerable code.
RemediationAI
The primary fix is to upgrade Google Chrome to version 150.0.7871.46 or later using Chrome's built-in update mechanism or by following the stable channel advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Enterprise administrators should enforce the update via Chrome Browser Cloud Management or Group Policy and audit all installed extensions, revoking any unrecognized or unauthorized ones to eliminate the delivery path. As a compensating control prior to patch deployment, restrict extension installation using Chrome Enterprise policies (ExtensionInstallBlocklist set to '*' with a defined Allowlist of approved extensions); this does not fix the underlying V8 out-of-bounds read but removes the only known delivery mechanism, with the trade-off of blocking unapproved legitimate extensions. SUSE Linux environments should monitor vendor channels for updated Chrome packages and apply them as available. Disabling extension support entirely via policy (ExtensionSettings) is the strongest workaround but will break extension-dependent workflows.
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today