EUVD-2026-34587
GHSA-2367-xw5p-w8h5
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Inappropriate implementation in DevTools in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a malicious extension to leak cross-origin data via a crafted Chrome Extension. (Chromium security severity: Medium)
AnalysisAI
Cross-origin data leakage in Google Chrome DevTools affects all versions prior to 149.0.7827.53, exploitable through a crafted malicious Chrome Extension. The inappropriate DevTools implementation allows an attacker who successfully social-engineers a victim into installing the extension to read data from cross-origin contexts - violating the browser's same-origin isolation guarantees at the DevTools layer. No public exploit code exists and no CISA KEV listing is present; EPSS at 0.02% (4th percentile) confirms low exploitation probability in the wild, making this a routine patch-cycle priority rather than an emergency response item.
Technical ContextAI
The root cause is classified as CWE-20 (Improper Input Validation), meaning the DevTools component fails to adequately validate or enforce boundaries when processing data or API calls originating from Chrome Extension contexts. Chrome DevTools exposes privileged inspection APIs - DOM traversal, network request inspection, JavaScript execution contexts - that are normally isolated from standard web content. An 'inappropriate implementation' in this layer means a crafted extension can invoke or manipulate DevTools behavior in a way that bypasses cross-origin restrictions, allowing data from otherwise-isolated origins to be read. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) places the attack vector as network-reachable with low complexity once the extension is installed, but scope remains unchanged (S:U), indicating the confidentiality leak is constrained within the browser's own security boundary rather than escaping to the underlying OS. No CPE string was provided in source data; the affected product is identifiable as Google Chrome desktop versions below 149.0.7827.53 across all supported platforms.
RemediationAI
Update Google Chrome to version 149.0.7827.53 or later - this is the vendor-confirmed fix documented in the stable channel advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Enterprise administrators managing Chrome via Google Admin or third-party MDM should deploy this update through standard browser management tooling. For environments where immediate patching is not possible, the most targeted compensating control is restricting Chrome Extension installation via the ExtensionInstallBlocklist or ExtensionAllowedTypes enterprise policies, which prevents untrusted extensions from reaching the vulnerable code path entirely - note this will require a policy infrastructure and may block legitimate user extensions, requiring an allowlist of approved extensions to preserve workflows. A more aggressive control is enabling the DeveloperToolsDisabled enterprise policy, which removes the DevTools attack surface entirely at the cost of blocking all developer tooling for affected users. Both controls should be treated as temporary mitigations pending patch deployment, as they introduce operational trade-offs.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today