EUVD-2026-50770
GHSA-9c37-rj77-8q8m
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious Chrome extension exploiting policy gap
-
DeliveryDistribute via phishing or deceptive listing
-
ExploitConvince target user to install extension
-
ExecutionExtension activates insufficient policy enforcement code path
-
PersistNavigation restrictions bypassed within Chrome session
-
ImpactAttacker redirects or circumvents enterprise navigation controls
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V4 - API and Web Service Server-side security enforcement
|
| Exploitation Conditions | Exploitation requires the target user to actively install a specifically crafted malicious Chrome extension on a Chrome desktop version prior to 151.0.7922.72 - the CVSS UI:R metric reflects this mandatory social engineering step. The attacker does not need any prior authentication or account on the target system (PR:N), but must successfully convince the user to install the extension, which is the primary exploitation barrier. Exploitation is further limited by: Chrome version must be below 151.0.7922.72; enterprise environments with ExtensionInstallAllowlist group policies permitting only vetted extensions are not exploitable via typical delivery; and the impact is restricted to navigation restriction bypass within the Chrome session - not remote code execution or credential theft. |
| Impact | The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N correctly captures network-accessible, low-complexity exploitation requiring user interaction but no prior authentication; the high integrity impact reflects meaningful bypass of navigation controls. However, several signals substantially reduce real-world priority: the EPSS score of 0.12% places this at the 2nd percentile - among the lowest exploitation probability scores - and the vulnerability is not listed in CISA KEV. The social engineering prerequisite (user must install the malicious extension) is a meaningful friction barrier, particularly in enterprise environments with extension allowlisting policies. The scope is unchanged (S:U), meaning exploitation is confined to the victim's Chrome session. This is assessed as a genuine medium-priority patch cycle item rather than an emergency - the high integrity CVSS component should not be treated as equivalent to remote code execution risk. |
| Exploit ScenarioDerived | An attacker crafts a Chrome extension that exploits the insufficient navigation policy enforcement, then distributes it through a phishing campaign, a deceptive web store listing, or direct sideloading link targeting users of Chrome prior to 151.0.7922.72. Once the victim installs the extension, it bypasses Chrome's navigation restrictions - potentially redirecting users to attacker-controlled pages, circumventing enterprise intranet access controls, or undermining content security policies enforced via navigation rules. No public exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 31, 2026
Navigation restriction bypass in Google Chrome's Extensions subsystem affects all desktop versions prior to 151.0.7922.72, enabling an attacker who convinces a user to install a crafted malicious extension to circumvent Chrome's navigation enforcement policies. The CWE-602 root cause indicates client-side policy logic can be subverted by a malicious extension actor, resulting in a high integrity impact with no confidentiality or availability exposure. No public exploit has been identified at time of analysis, and the EPSS score of 0.12% (2nd percentile) indicates very low exploitation probability, despite the CVSS 6.5 medium-severity rating.
RemediationAI
Update Google Chrome to version 151.0.7922.72 or later via the stable channel; this is a vendor-released patch as confirmed by the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. As a compensating control before patching, enterprise administrators should enforce extension allowlisting via Chrome group policies (ExtensionInstallAllowlist and ExtensionInstallBlocklist), restricting installation to vetted extensions only - note this will block user-initiated installation of unapproved extensions and may require an approval workflow that could affect productivity. In managed environments, disabling sideloading via the BlockExternalExtensions policy further reduces the attack surface. User awareness training on avoiding installation of unverified extensions provides a procedural layer but is not a technical substitute for patching.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is rooted in CWE-602 (Client-Side Enforcement of Server-Side Security), meaning Chrome's extension policy enforcement mechanism fails to adequately validate or enforce navigation restrictions from the browser engine's trusted context, allowing a crafted extension to override or bypass those controls client-side. Chrome's Extensions system grants extensions declarative permissions and API access gated by policy; insufficient enforcement here means the policy boundary between trusted browser navigation logic and extension-controlled behavior is porous. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covering all Chrome desktop versions prior to 151.0.7922.72. The Chromium issue tracker reference (https://issues.chromium.org/issues/517597914) may contain additional technical detail, though the bug may be access-controlled.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Extension distributed over network (AV:N), user must install it (UI:R), no prior auth needed (PR:N), impact is integrity-only navigation bypass with no confidentiality or availability consequence (I:H, C:N, A:N).
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Insufficient policy enforcement in Extensions in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a crafted Chrome Extension. (Chromium security severity: Medium)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB