Google Chrome EUVD-2026-34769

Exploitation requires that a user be convinced to manually install a maliciously crafted Chrome Extension on an affected Chrome version (prior to 149.0.7827.53) - this user interaction is a hard prerequisite encoded in the CVSS vector as UI:R. The attacker does not need any authentication to the target system (PR:N), but the social engineering step to install the extension is a non-trivial barrier that significantly limits opportunistic exploitation. Exploitation is further limited to the browser's security scope (S:U - Unchanged), meaning the attacker cannot directly pivot to OS-level privileges through this vulnerability alone. The flaw is specific to the Extensions subsystem, so environments where Chrome extension installation is blocked via enterprise policy are not exploitable. There is no indication of exploitation via drive-by download or without explicit user consent to install the extension.

The real-world risk of this vulnerability is low despite a medium CVSS base score of 6.3. The CVSS vector AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L indicates network-reachable exploitation with no authentication required but mandatory user interaction - specifically, the user must be convinced to install a malicious extension. This social engineering prerequisite is a meaningful friction point. Chromium's own security team independently rated the severity as Low, which conflicts slightly with the NVD Medium calculation; the discrepancy likely reflects Google's judgment that extension-install user interaction is a substantial barrier. The EPSS score of 0.01% at the 1st percentile strongly suggests no meaningful observed exploitation in the wild. No KEV listing exists, and no public exploit or POC has been identified. The S:U (Unchanged scope) further constrains impact to the browser context. Overall, this is a low-priority issue for most organizations - highest concern for enterprises managing Chrome via extension policies, where adversarial extensions could be more plausibly introduced.

An attacker crafts a malicious Chrome extension designed to exploit the improper privilege management flaw and hosts or distributes it via a phishing campaign, fake software bundle, or compromised extension repository. The attacker convinces the target user - through social engineering, deceptive advertising, or a lookalike extension page - to manually install the extension. Once installed, the extension leverages the CWE-269 flaw to escalate its privileges beyond its declared permissions, potentially accessing sensitive browser data such as cookies, saved passwords, or intercepting web sessions. No public proof-of-concept exploit code has been identified at time of analysis.