EUVD-2026-50648
GHSA-635j-7735-7jm2
Severity by source
Sources disagree (Low–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack requires a locally installed malicious extension and user interaction (AV:L, UI:R); it crosses the extension privilege boundary (S:C) but yields limited privilege escalation consistent with the vendor's Low rating, so C/I:L, A:N.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
5DescriptionCVE.org
Insufficient policy enforcement in DevTools in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension to perform privilege escalation via a crafted Chrome Extension. (Chromium security severity: Low)
AnalysisAI
Privilege escalation in Google Chrome's DevTools component (all desktop builds prior to 151.0.7922.72) lets a malicious browser extension bypass DevTools policy enforcement to gain capabilities beyond its declared permissions. Exploitation is not remote-in-a-vacuum: an attacker must first convince a victim to install a crafted extension, after which the flaw escalates that extension's effective privileges within the browser. Google fixed the issue in the stable channel and rated the Chromium security severity as Low; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Technical ContextAI
The vulnerability lives in Chrome's DevTools subsystem, which exposes powerful debugging and inspection APIs (the Chrome DevTools Protocol) that are normally gated by policy checks so that untrusted extension code cannot reach privileged surfaces. The root cause is classed as CWE-693 (Protection Mechanism Failure): a security control that is supposed to enforce a policy boundary is insufficiently applied, allowing a crafted extension to reach DevTools functionality it should not. The affected product per CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* - i.e. the Google Chrome desktop application across versions below the fixed build - and the same Chromium engine underlies other Chromium-based browsers that consume the upstream fix. Because the abused surface (DevTools) is an intended, always-present part of the browser rather than an optional feature, the weakness is about a missing/weak enforcement check rather than a memory-safety defect.
RemediationAI
Vendor-released patch: Google Chrome 151.0.7922.72 (stable channel). Update Chrome to 151.0.7922.72 or later - for most users Chrome's automatic update mechanism applies this after a browser restart, so ensure clients are restarted and that managed/enterprise auto-update is not disabled; the advisory is https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Because exploitation requires installing a malicious extension, an effective compensating control until patched is to restrict extension installation via enterprise policy: set ExtensionInstallBlocklist to '*' and use ExtensionInstallAllowlist to permit only vetted extension IDs (side effect: users can no longer self-install extensions, which may disrupt legitimate workflows), and/or force-install only approved extensions via ExtensionInstallForcelist. Auditing already-installed extensions and removing untrusted ones further reduces exposure. Chromium-based browsers should be updated to the build that incorporates the corresponding upstream fix.
Same weakness CWE-693 – Protection Mechanism Failure
View allSame technique Privilege Escalation
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today