Google Chrome EUVD-2026-34699

The attacker must successfully convince the target user to install a malicious Chrome Extension - either from outside the Chrome Web Store (sideloaded) or through a store-published extension that bypasses Google's vetting. This social engineering prerequisite is the primary limiting factor. Chrome must be running a version prior to 149.0.7827.53 on a desktop platform. The DevTools component must be reachable by extension APIs in the browser's execution context; enterprise environments with DeveloperToolsAvailability policy set to restrict DevTools may limit exposure. Authentication requirements: the CVSS vector specifies PR:N (no prior authentication to the target system required), but the installation of the extension itself constitutes an implicit user interaction step that the UI:N vector rating appears to contradict - treat authentication requirements as 'no system authentication required, but user must be socially engineered into extension installation.'

The CVSS base score is 5.9 (Medium), driven by C:H (high confidentiality impact) but attenuated by AC:H (high attack complexity). A notable discrepancy exists between the CVSS vector and the description: UI:N (no user interaction) is specified in the vector, yet the description explicitly states the attacker must convince a user to install a malicious extension - which constitutes user interaction (UI:R). This inconsistency should be verified with the vendor, as it affects real-world exploitability assessments. PR:N indicates no prior privileges are required on the attacker's part. EPSS is 0.01% (1st percentile), strongly suggesting this vulnerability is not being broadly exploited opportunistically. The vulnerability is not listed in CISA KEV, and no public exploit code has been identified at time of analysis. Despite the High confidentiality impact in CVSS, the realistic risk is constrained by the social engineering prerequisite (extension installation), Chrome's Web Store vetting processes, and the very low EPSS signal. Organizations permitting sideloading of unpublished extensions or operating in high-value targeted environments should treat this with elevated priority relative to the EPSS alone.

An attacker crafts a Chrome Extension that, upon installation, leverages unguarded DevTools APIs to scan process memory for sensitive artifacts such as authentication tokens, session cookies, or plaintext credentials held in memory by active browser tabs. The attacker distributes the extension via phishing, a typosquatted extension store page, or direct social engineering targeting a specific user, convincing them to install it manually. Once installed, the extension silently reads memory and exfiltrates findings to an attacker-controlled endpoint. No public POC has been identified at time of analysis.