EUVD-2026-28111Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Network vector and no attacker privileges required, but mandatory user interaction (extension install) and only partial confidentiality impact from cross-origin data leak.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
Insufficient policy enforcement in DevTools in Google Chrome prior to 148.0.7778.96 allowed an attacker who convinced a user to install a malicious extension to leak cross-origin data via a crafted Chrome Extension. (Chromium security severity: Low)
AnalysisAI
Cross-origin data leakage in Google Chrome's DevTools prior to version 148.0.7778.96 allows a network-positioned attacker to exfiltrate cross-origin data by convincing a user to install a malicious Chrome Extension that exploits insufficient policy enforcement. The attacker must socially engineer the target into installing the malicious extension, after which the extension can bypass cross-origin isolation policies through DevTools APIs. No active exploitation has been confirmed (CISA KEV absent), and EPSS places this in the 4th percentile, indicating minimal real-world exploitation pressure.
Technical ContextAI
The vulnerability resides in Google Chrome's DevTools subsystem, which is a set of web developer tools built directly into the browser. The root cause is classified as CWE-693 (Protection Mechanism Failure), specifically insufficient policy enforcement that allows a crafted Chrome Extension to access or leak data across origin boundaries - a fundamental browser security guarantee. Chrome Extensions interact with DevTools through extension APIs, and the policy enforcement gap allows a malicious extension to bridge cross-origin data that should be isolated. The affected product is identified via CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering Chrome releases prior to 148.0.7778.96 on all platforms. Cross-origin data protection (Same-Origin Policy) is a cornerstone of browser security, and bypassing it via DevTools policy failures represents a structural trust violation in the browser's extension permission model.
RemediationAI
Upgrade Google Chrome to version 148.0.7778.96 or later, which contains the vendor-released patch for this vulnerability. The stable channel update is documented at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html. Chrome typically auto-updates, so verifying the installed version via chrome://settings/help and restarting the browser is sufficient for most users. As a compensating control prior to patching, enterprise administrators can restrict extension installation via Chrome policy (ExtensionInstallBlocklist) to allow only trusted, reviewed extensions - this eliminates the social engineering vector entirely. Restricting DevTools access via the DeveloperToolsAvailability policy is a secondary control that removes the exploitation surface, but note it also impacts legitimate developer workflows. Organizations with Chromium-based browser deployments on Red Hat or SUSE should apply distribution-provided updates when available.
Same weakness CWE-693 – Protection Mechanism Failure
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: MediumShare
External POC / Exploit Code
Leaving vuln.today