EUVD-2026-40734
GHSA-f4wc-qc7x-8g92
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Network-delivered attack with no attacker privileges needed; mandatory extension-install interaction captured by UI:R; CSP bypass yields integrity-only, limited impact with no scope change.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Insufficient policy enforcement in Extensions in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinced a user to install a malicious extension to bypass content security policy via a crafted Chrome Extension. (Chromium security severity: Low)
AnalysisAI
Content Security Policy bypass in Google Chrome's Extensions subsystem prior to version 150.0.7871.47 allows an attacker who socially engineers a victim into installing a crafted malicious extension to circumvent CSP protections, yielding limited integrity impact. CVSS UI:R and EPSS at 0.12% (2nd percentile) confirm this is a low-probability, user-interaction-dependent attack with no confidentiality or availability consequence. No KEV listing, no known POC, and Google's own 'Low' severity rating collectively position this as a low operational priority despite broad product prevalence.
Technical ContextAI
This vulnerability affects Google Chrome's extension policy enforcement layer, where the browser insufficiently validates Content Security Policy constraints when processing crafted Chrome Extensions. CWE-602 (Client-Side Enforcement of Server-Side Security) describes the root cause class: security logic that should be authoritative on the server or enforced uniformly by the browser engine is instead bypassable through client-controlled inputs - in this case, a malicious extension manifest or scripting behavior. CSP is a web security standard instructing browsers to restrict which scripts, styles, and resources a page may load; a bypass allows the extension to execute policy-restricted content in page contexts where CSP should have blocked it. The affected CPE corresponds to Google Chrome desktop releases across platforms prior to 150.0.7871.47, confirmed by EUVD-2026-40734.
RemediationAI
Update Google Chrome to version 150.0.7871.47 or later; this is the vendor-released patch for this vulnerability, announced in the Chrome stable channel update at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Chrome typically auto-updates, but enterprise deployments should verify managed endpoints are running 150.0.7871.47 or above. As a compensating control for environments that cannot immediately update, enterprise administrators should enforce Chrome extension installation policies using ExtensionInstallBlocklist (set to '*' to block all) combined with ExtensionInstallAllowlist for approved extensions - this directly eliminates the installation vector required for exploitation, though it will prevent users from self-installing any extension and may require a helpdesk process for legitimate additions. Enabling Enhanced Safe Browsing can provide supplemental detection of known-malicious extensions at install time but does not substitute for patching.
Same technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today