EUVD-2026-40510
GHSA-fm8g-chhx-hqqg
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
AV:N/UI:R for web delivery, AC:H reflecting the required prior renderer compromise, PR:N as no browser account is needed, and S:C because escaping the renderer sandbox crosses a security boundary.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Insufficient policy enforcement in Extensions in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to perform privilege escalation via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Privilege escalation in Google Chrome's Extensions subsystem before version 150.0.7871.47 lets an attacker who has already compromised the renderer process break out of that context and gain elevated privileges by delivering a crafted HTML page. Google rates the Chromium severity as High, and the assigned CVSS is 7.5 (AV:N/AC:H). There is no public exploit identified at time of analysis, EPSS is low (0.21%, 11th percentile), and CISA's SSVC framework records exploitation status as none, indicating this is currently a patch-and-move-on issue rather than an active threat.
Technical ContextAI
The flaw lives in Chromium's extension policy-enforcement layer, the component responsible for confining what extension-related code and pages may do across process boundaries. It is classified as CWE-20 (Improper Input Validation), meaning the browser fails to sufficiently validate or enforce policy on input crossing from a lower-trust context, allowing security-relevant checks to be bypassed. Because Chromium uses a multi-process sandbox model where the renderer is deliberately the least-trusted process, this class of 'insufficient policy enforcement' bug matters as a second-stage primitive: once an attacker controls the renderer, weak enforcement in the Extensions path becomes a lever to reach a higher-privileged context. The affected surface is the Chrome application itself (cpe:2.3:a:google:chrome), and the fix ships across all Chrome desktop platforms via the Stable channel update.
RemediationAI
Vendor-released patch: update Google Chrome to 150.0.7871.47 or later via the Stable channel, per Google's advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html; on managed fleets, verify auto-update is enabled and force a browser relaunch so the new binary loads, since Chrome only applies updates on restart. There is no standalone configuration workaround for this specific policy-enforcement flaw, but because exploitation requires a prior renderer compromise, compensating controls that harden the renderer meaningfully reduce risk: enable Chrome's Site Isolation (default on desktop) and the Enhanced/Strict Site Isolation enterprise policy, deploy extension allow-listing via ExtensionInstallAllowlist/ExtensionInstallBlocklist to shrink the attack surface in the affected Extensions path (trade-off: may block legitimately needed add-ons), and restrict browsing to trusted sites through enterprise URL policies. Users of Chromium-based browsers (Edge, Brave, Opera, Vivaldi) should apply their vendor's build that incorporates the upstream fix once released.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Privilege Escalation
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today