EUVD-2026-40636
GHSA-j5cg-h7g5-mx9v
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
AC:H reflects mandatory social-engineering for extension installation; UI:R for explicit user approval; I:L for UI deception with no data exfiltration or availability impact.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Insufficient policy enforcement in Extensions in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinced a user to install a malicious extension to perform UI spoofing via a crafted Chrome Extension. (Chromium security severity: Medium)
AnalysisAI
UI spoofing via crafted extension in Google Chrome prior to 150.0.7871.47 allows a network-positioned attacker who successfully social-engineers a user into installing a malicious extension to misrepresent browser interface elements through insufficient policy enforcement in the Extensions subsystem. The vulnerability is rated CVSS 3.1 (Low) with high attack complexity due to the required social engineering, and carries no integrity impact beyond UI deception. No active exploitation is confirmed - EPSS is 0.13% (3rd percentile) and SSVC categorizes exploitation status as none, placing this squarely in a low-urgency remediation tier.
Technical ContextAI
The flaw is rooted in CWE-451 (User Interface Misrepresentation of Critical Information), which covers cases where software presents information in a misleading way that can deceive users about security-relevant decisions. Chrome's extension policy enforcement framework is responsible for restricting what extensions can render or manipulate in the browser UI; insufficient enforcement here allows a crafted extension to override or mimic trusted UI chrome elements such as address bars, permission dialogs, or security indicators. The affected component is the Chromium Extensions subsystem, covering all platforms where Chrome runs, as reflected in the wildcard CPE string cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*. The Chromium issue tracker entry (issues.chromium.org/issues/513286820) likely contains technical specifics but is typically access-restricted during the patch window.
RemediationAI
The vendor-released patch is Chrome 150.0.7871.47, confirmed by the Google Chrome stable channel update advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Organizations should verify that Chrome auto-update is enabled and confirm affected endpoints have received the update via fleet management tooling. As a compensating control in enterprise environments, administrators can use Chrome's ExtensionInstallBlocklist and ExtensionInstallAllowlist group policies (or equivalent MDM profiles) to restrict which extensions users may install, directly eliminating the social-engineering attack surface - this is the most actionable pre-patch mitigation. User awareness about unsolicited extension installation requests is a secondary, behavioral control with limited measurable efficacy. No workarounds are documented that fully eliminate the underlying policy enforcement gap without restricting extension functionality.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today