Google Chrome CVE-2026-17739

Exploitation requires the victim to actively install a malicious Chrome extension - this is the single critical prerequisite, confirmed by CVSS UI:R and the CVE description's explicit phrasing 'convinced a user to install a malicious extension.' The extension must be crafted to exploit the specific policy enforcement gap in the Extensions subsystem. No authentication to any web service is required (CVSS PR:N), but the social engineering barrier to induce extension installation is the primary limiting factor. Exploitation is further limited to Chrome desktop versions prior to 151.0.7922.72; environments with enterprise extension allowlisting policies effectively negate the attack since installation of unapproved extensions is blocked at the policy level. There is no network-reachable exploit path - a local, interactive user session is required.

The CVSS 3.1 base score of 4.2 is driven by AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N - the AC:H reflects the mandatory social engineering step of convincing the victim to install a malicious extension, which significantly constrains scalability. EPSS at 0.13% (3rd percentile) is extremely low, consistent with the high exploitation complexity and absence of a known POC. The vulnerability is not listed in CISA KEV, meaning no confirmed active exploitation campaign has been observed. The vendor-assigned scope is Unchanged (S:U), though UXSS semantically implies cross-origin impact - this is a mild signal of potential underscoring; see assessed_cvss_vector for analyst perspective. Real-world risk is genuine but operationally constrained: mass exploitation is unlikely given the required user interaction, but targeted campaigns (e.g., spear-phishing a sideloaded extension) are plausible. The primary risk population is enterprise environments where users have permission to install extensions outside the Chrome Web Store.

An attacker crafts a malicious Chrome extension that exploits the insufficient policy enforcement to run content scripts with cross-origin UXSS capabilities, then distributes it via phishing, a compromised third-party site, or social media (e.g., 'install this productivity tool'). Once a victim installs and activates the extension, it injects attacker-controlled scripts into web pages across origins - potentially harvesting session tokens, credentials, or sensitive page content from banking, email, or corporate web applications open in other tabs. No public POC has been identified at time of analysis, so exploitation requires attacker-developed tooling.