Google Chrome CVE-2026-78960

Exploitation requires the victim to be socially engineered into installing a specially crafted malicious Chrome extension - this is confirmed by the CVSS UI:R (Required) metric. The victim must actively install the extension, which in non-enterprise Chrome environments triggers an installation prompt disclosing the extension's requested permissions. Exploitation is not possible against Chrome instances where extension installation is disabled via enterprise policy (ExtensionInstallBlocklist with wildcard), nor against users who decline the installation prompt. The flaw does not enable passive network-based exploitation; an attacker cannot trigger the data leak without the victim's installation action. No specific Chrome feature flag or non-default configuration beyond extension installation is identified as a prerequisite.

The CVSS 3.1 base score of 6.5 (Medium) is driven by a high confidentiality impact (C:H) with a network attack vector (AV:N) and no authentication prerequisite (PR:N), but is moderated by the required user interaction (UI:R) and absence of integrity or availability impact (I:N/A:N). The EPSS score of 0.27% at the 18th percentile indicates that exploitation is currently rare relative to other CVEs tracked by FIRST - this is consistent with the social engineering delivery requirement, which raises the effective attack bar well above what the raw CVSS suggests. There is no CISA KEV listing and no public proof-of-concept identified at time of analysis. The Chromium team's internal severity of 'Medium' aligns with this risk picture. The primary real-world risk scenario involves targeted attacks against high-value individuals rather than automated mass exploitation; organizations with enforced extension policies (enterprise allowlists, Chrome Web Store-only installs) have substantially reduced exposure compared to consumer or unmanaged deployments.

An attacker crafts a Chrome extension that exploits the cross-origin data leak in Chrome's Extensions subsystem, then distributes it via a phishing campaign, fake software download site, or impersonation of a legitimate productivity extension to convince a targeted user to install it. Once installed, the extension silently reads data from web pages belonging to origins outside its declared permissions - such as a banking session, webmail content, or intranet page - and transmits it to an attacker-controlled server. No public proof-of-concept code has been identified at time of analysis, but the attack requires only a developer-capable adversary able to author a Chrome extension.