EUVD-2026-34730
GHSA-x732-wxxw-qf5c
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessPosition on adjacent network
-
DeliveryIntercept extension traffic
-
ExploitDeliver crafted Chrome Extension
-
ExecutionUser accepts install or update
-
PersistTrigger inappropriate Extensions implementation
-
ImpactExecute arbitrary code in sandbox
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V15 - Secure Coding and Architecture Trusted source inclusion only
|
| Exploitation Conditions | The attacker must occupy a privileged network position on the same adjacent network segment as the victim (AV:A) - for example, the same Wi-Fi LAN, VPN segment, or an upstream router/proxy capable of intercepting or modifying extension-related HTTP(S) traffic. The victim must be running Chrome prior to 149.0.7827.53, must use Chrome Extensions (the affected subsystem), and must perform a user interaction (UI:R) such as accepting an install/update prompt or loading content that activates the crafted extension. High attack complexity (AC:H) means the attacker must reliably win a network race or satisfy non-trivial protocol/timing requirements against the extension flow. Limiting factors: code execution is confined to the sandbox (S:U) rather than the host OS, the bug does not work over the open Internet from an arbitrary remote attacker, and Chrome's auto-update on a healthy network will close the window quickly. |
| Impact | Signals are mixed and weighted toward lower real-world risk despite the 7.1 CVSS. The CVSS vector (AV:A/AC:H/PR:N/UI:R) requires adjacent-network positioning, high attack complexity, and user interaction - all meaningful barriers - while the EPSS score of 0.01% (1st percentile) suggests negligible expected exploitation activity. The issue is not on CISA KEV and no POC is known, aligning with Chromium's own 'Low' internal severity rating. The principal residual risk is in hostile-network scenarios (public Wi-Fi, compromised LAN, captive portals) where an attacker can intercept extension traffic and convince a user to install or accept a crafted extension; for typical enterprise users on managed networks with auto-updates enabled, real priority is modest and a routine Chrome update cycle is sufficient. |
| Exploit ScenarioDerived | An attacker sharing a coffee-shop or conference Wi-Fi with the victim intercepts or manipulates traffic related to a Chrome Extension (for example, an extension's update fetch or a captive-portal-mediated install prompt) and serves a crafted extension payload. The user interacts with the extension prompt or visits a page that triggers extension loading, after which the malicious extension executes code inside Chrome's sandbox to access browser-mediated data within the sandbox boundary. No public exploit identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 05, 2026
Remote code execution within the Chrome renderer sandbox affects Google Chrome desktop builds prior to 149.0.7827.53, stemming from an inappropriate implementation in the Extensions subsystem. An attacker in a privileged network position can deliver a crafted Chrome Extension that, with user interaction, executes arbitrary code confined to the sandbox. No public exploit identified at time of analysis and EPSS probability is very low (0.01%), but a vendor patch is available.
RemediationAI
Vendor-released patch: update Google Chrome to 149.0.7827.53 or later on the Stable channel as published in the Chrome Releases advisory (https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html); managed deployments should verify auto-update is enforced and roll the new build through MDM/Group Policy. Users of Chromium-based browsers should apply their respective vendor's update once it incorporates the fixed Chromium baseline. As compensating controls until patching completes, restrict extension installation to an enterprise allowlist via the ExtensionInstallAllowlist/ExtensionInstallForcelist policies (trade-off: blocks legitimate ad-hoc extension use), require employees to avoid untrusted networks or to route through a corporate VPN to neutralize the adjacent-network prerequisite (trade-off: VPN performance and split-tunnel exceptions), and disable developer mode and sideloading via ExtensionDeveloperModeSettings (trade-off: impedes internal extension development workflows).
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw resides in Chromium's Extensions subsystem, which manages installation, update, and execution of browser extensions packaged as CRX bundles and governed by the manifest/permission model. The CWE-829 classification (Inclusion of Functionality from Untrusted Control Sphere) indicates the browser improperly trusts or loads extension-controlled content or update payloads sourced from a channel an adjacent-network attacker can influence - for example, an extension update or resource fetch that lacks sufficient integrity validation. Because the resulting code execution is constrained to the sandbox (Scope: Unchanged in the CVSS vector), the attacker gains code execution inside the extension/renderer process rather than on the underlying host, though Chromium itself rates the severity as Low.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Low–High)AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Inappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.53 allowed an attacker in a privileged network position to execute arbitrary code inside a sandbox via a crafted Chrome Extension. (Chromium security severity: Low)
Executive ViewAI
Google Chrome is affected by a remote code execution vulnerability in versions prior to 149.0.7827.53 that could expose critical business systems to unauthorized access and data compromise through malicious browser extensions. Organizations with widespread Chrome deployment face elevated risk of credential theft, malware injection, and compliance violations from successful exploitation. Swift patching is required to mitigate enterprise-wide exposure.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Related Vulnerabilities in Google Chrome Security Fixes (149.0.7827.53)
View all 72Vendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB