Google Chrome CVE-2026-7962

The vulnerability requires a malicious Chrome extension to be installed and active in the user's Chrome browser. Exploitation is restricted to the network and local resources accessible from the user's machine. The extension must have the DirectSockets permission declared in its manifest to access the vulnerable API. Legitimate user interaction is mandatory-the attacker cannot force extension installation; the user must explicitly accept the extension installation prompt. The vulnerability does NOT affect users who do not install untrusted extensions or organizations with extension installation policies that block unauthorized extensions. The DirectSockets API is only available to extensions explicitly requesting it, not to all extensions by default, providing a secondary control limiting exposure.

CVSS 5.4 (Medium) reflects network accessibility but limited direct impact (confidentiality and integrity, no availability loss) and mandatory user interaction requirement. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) confirms unauthenticated network-based attack with low complexity but critically requires user interaction (UI:R). Real-world risk is constrained by the extension installation requirement-this is not a direct network exploit but rather a capability-escalation flaw for already-installed extensions. An attacker must socially engineer users into installing a malicious extension, making this a secondary compromise vector rather than a primary initial access method. The Medium chromium severity and information disclosure tag align with targeted misuse scenarios (lateral movement within networks, reconnaissance of local services) rather than broad exploitation potential. Automated exploitation is limited by the UI requirement, reducing mass-exploitation risk.

An attacker distributes a malicious Chrome extension via social engineering, fake app stores, or compromised legitimate extension accounts. Upon user installation, the extension leverages the unpatched DirectSockets API vulnerability to bypass socket access policies and directly read data from local network services (e.g., unencrypted IoT devices, internal HTTP services, database ports) or modify network traffic. This enables theft of local credentials, network reconnaissance, or lateral movement into corporate internal networks without further user interaction after the initial extension install.