EUVD-2026-40749
GHSA-4h89-vwxj-5q9p
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
UI:R corrects the provided vector - the description explicitly requires user installation of a malicious extension, mandating active user interaction; all other metrics retained.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Inappropriate implementation in Views in Google Chrome on ChromeOS prior to 150.0.7871.47 allowed an attacker who convinced a user to install a malicious extension to obtain potentially sensitive information from process memory via a crafted Chrome Extension. (Chromium security severity: Low)
AnalysisAI
Process memory disclosure in Google Chrome's Views UI framework on ChromeOS allows a crafted extension, once installed by a user, to read potentially sensitive data from Chrome's process memory. All ChromeOS Chrome versions prior to 150.0.7871.47 are affected; desktop Chrome on Windows, macOS, and Linux is not confirmed in scope. No public exploit has been identified at time of analysis, and Chromium's own internal severity rating is Low - tempering the NVD CVSS 5.9 score - indicating Google's security team assessed limited practical exploitability.
Technical ContextAI
The vulnerability resides in the Views component of Chromium, the C++ UI toolkit responsible for rendering Chrome's browser interface on ChromeOS. CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) identifies the root cause as an inappropriate implementation within that layer - specifically, memory regions accessible to the extension process that should be isolated are not properly guarded. Chrome Extensions operate within a sandboxed renderer context, but this flaw allows a crafted extension to reach across that boundary and read data from the broader browser process memory, potentially capturing in-memory credentials, session tokens, or form data. The affected scope per EUVD-2026-40749 and the CVE description is strictly Chrome on ChromeOS, not the cross-platform Chromium codebase in its entirety.
RemediationAI
Update Google Chrome on ChromeOS to version 150.0.7871.47 or later, as documented in the Google Stable Channel advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. This is the vendor-released patch and the primary fix. As a compensating control for environments that cannot immediately apply the update, enforce Chrome Extension policy via the ChromeOS Admin Console to restrict extension installation to an admin-approved allowlist - this directly eliminates the malicious extension delivery vector without requiring a patch cycle. Disabling all user-initiated extension installs via policy provides stronger protection but will disrupt legitimate end-user workflows and requires change management. Enforcing Web Store review requirements (blocking sideloading via developer mode) adds friction to extension-based attacks at low operational cost.
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today