EUVD-2026-50730
GHSA-x4cw-wg5h-4qx6
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Attacker delivers extension over network (AV:N), no special conditions needed (AC:L), no attacker credentials required (PR:N), user must install extension (UI:R), limited cross-origin data read with no write or availability impact (C:L/I:N/A:N).
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Inappropriate implementation in Extensions in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension to leak cross-origin data via a crafted Chrome Extension. (Chromium security severity: Medium)
AnalysisAI
Cross-origin data leakage in Google Chrome's Extensions subsystem prior to version 151.0.7922.72 enables a crafted extension to bypass same-origin policy protections and read data from cross-origin browser contexts. Exploitation requires convincing a target user to install a malicious Chrome Extension, placing this firmly in the social-engineering-dependent threat category. No active exploitation is confirmed (not in CISA KEV), no public POC has been identified, and an EPSS of 0.13% at the 3rd percentile reflects minimal real-world exploitation probability at time of analysis.
Technical ContextAI
Google Chrome's extension platform implements the Chromium Extension API with cross-origin isolation controls intended to prevent extensions from accessing content across origins without explicit permission grants. CWE-284 (Improper Access Control) identifies the root cause as a failure in enforcing those access controls within the Extensions subsystem - a crafted extension can circumvent the same-origin policy boundary and read data from pages of differing origins that the user is visiting. The affected component spans all Chrome desktop releases below 151.0.7922.72, as reflected in CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering Windows, macOS, and Linux platforms. The Chromium issue tracker entry (https://issues.chromium.org/issues/513502990) is the upstream record of the flaw, reported by the Chrome security team.
RemediationAI
Update Google Chrome to version 151.0.7922.72 or later, the confirmed patched release per the Chrome Stable Channel Update advisory at http://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome auto-updates by default; administrators can verify or force the update via chrome://settings/help or through enterprise management platforms (Google Admin Console, Microsoft Intune). As a compensating control before patching - or as a defense-in-depth measure - enterprise administrators should enforce an extension allowlist via Chrome's ExtensionInstallAllowlist and ExtensionInstallBlocklist Group Policy settings, permitting only vetted, approved extensions; this directly eliminates the social engineering vector this vulnerability requires. Additionally, disabling developer mode extensions (DeveloperToolsAvailability policy) prevents sideloading of unsigned extensions outside the Web Store review pipeline. Both controls carry the trade-off of reduced user flexibility but substantially reduce the attack surface for this and similar extension-based vulnerabilities.
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today