Google Chrome CVE-2026-17998

Exploitation requires that the victim user actively install a specifically crafted malicious Chrome extension - this is the essential prerequisite and primary limiting factor. The CVSS UI:R metric confirms mandatory active user interaction; without the install action, the vulnerability cannot be triggered. The attacker requires no prior authentication or privileges on the target system (PR:N), but must overcome the social engineering barrier of convincing the user to complete the install. The vulnerability is confined to Chrome's Extensions UI subsystem and does not affect the browser in the absence of the malicious extension. No non-default Chrome configuration or special server-side deployment condition is required. What limits exploitation: the user must take a deliberate install action, Chrome's install prompts still appear (the flaw is in how security UI is rendered post-install, not in bypassing the install gate), and the impact is scoped to UI deception rather than code execution or data exfiltration.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N, score 4.3) reflects a network-reachable attack with no attacker-side authentication and low complexity, but with mandatory victim interaction - the user must be convinced to install a malicious extension. Scope is unchanged, meaning the impact is bounded to the browser. The integrity impact is Low and there is no confidentiality or availability consequence. EPSS at 0.10% (1st percentile) indicates near-zero probability of exploitation in the near term, which is consistent with Chromium's own 'Low' severity classification. No CISA KEV listing exists and no public POC has been identified, so all exploitation risk signals are at their floor. The primary realistic threat is as an amplifier in a phishing campaign - the spoofed UI lowers the user's defenses when interacting with the malicious extension - rather than a standalone exploitation vector. For most organizations, this is a patch-and-move-on item rather than an emergency priority.

An attacker crafts a Chrome extension that abuses the incorrect security UI to misrepresent its permissions or spoof the visual identity of a trusted extension. The attacker distributes this extension via a phishing email, a fake software download page, or a compromised web property, persuading the victim to click through the installation prompt. Once installed, the spoofed UI deceives the user into granting the extension elevated trust or interacting with it as though it were legitimate, enabling follow-on actions such as credential harvesting or further social engineering.