Google Chrome CVE-2026-17976

Exploitation requires a user running Google Chrome prior to version 151.0.7922.72 to be actively convinced to install a malicious browser extension - this is a non-default, user-initiated action that Chrome presents with permission prompts and, for non-Web-Store installs, additional warnings. The crafted domain name trigger is specific to the Extensions policy enforcement subsystem and is not reachable without a loaded extension. Exploitation is blocked entirely in environments where Chrome Enterprise ExtensionInstallBlocklist or equivalent MDM-enforced allowlist policies are active, as these prevent unauthorized extension installation at the platform level. The vulnerability does not affect users who restrict extension installs to verified Web Store sources under organizational policy. Impact is bounded to integrity only (no confidentiality or availability impact per CVSS), and the unchanged scope metric confirms the attacker cannot leverage this to escape Chrome's sandbox or affect the underlying operating system.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N characterizes this as a network-reachable flaw requiring no attacker authentication but mandating active user participation (extension installation), with impact limited to low-severity integrity violations and no scope change. The EPSS score of 0.12% at the 2nd percentile is exceptionally low, indicating the broader security community assesses exploitation as highly unlikely in the near term. There is no CISA KEV listing and no publicly available proof-of-concept, both consistent with the low EPSS. The social engineering dependency is the dominant risk-reducing factor: Chrome's Web Store policies and browser warnings create meaningful friction for unsolicited extension installs. Enterprises enforcing extension allowlists via Chrome Enterprise policy are effectively not exposed. Real-world risk is low - this is not a drive-by or unassisted exploitation scenario, and the impact ceiling (integrity only, unchanged scope) is modest even if exploitation succeeds.

An attacker crafts a Chrome extension containing logic that uses a specially constructed domain name to circumvent extension policy enforcement, then distributes it via a phishing campaign, fake software bundle, or third-party extension repository, persuading a target user to install it outside the Chrome Web Store's standard review process. Once installed, the extension exploits the insufficient policy check to perform unauthorized actions against domains it should not have permission to access - such as injecting scripts or reading page content on restricted sites. No public proof-of-concept code has been identified at time of analysis, and the attack chain requires sustained social engineering effort, limiting its utility for broad or automated exploitation.