EUVD-2026-42480
GHSA-6p2r-gg8g-33f2
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
UI:R reflects mandatory extension installation by victim; C:L reflects bounded out-of-bounds read only; I:N and A:N confirmed by no write or crash impact.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Integer overflow in Extensions API in Google Chrome prior to 150.0.7871.115 allowed an attacker who convinced a user to install a malicious extension to perform an out of bounds memory read via a crafted Chrome Extension. (Chromium security severity: High)
AnalysisAI
Integer overflow in Google Chrome's Extensions API (versions prior to 150.0.7871.115) enables an out-of-bounds memory read, leaking limited browser memory content to a crafted malicious extension. Exploitation requires convincing a user to install the attacker-controlled extension, constraining this to social engineering or supply chain scenarios rather than opportunistic mass exploitation. No public exploit has been identified and EPSS sits at 0.10% (1st percentile), making real-world exploitation probability very low despite Chromium's internal 'High' severity designation.
Technical ContextAI
The vulnerability resides in Chrome's Extensions API - the C++ binding layer that mediates between JavaScript extension code and browser internals. CWE-190 (Integer Overflow or Wraparound) occurs when an arithmetic operation on an integer type produces a value exceeding the type's maximum, wrapping around to a small or negative value. When this corrupted value is subsequently used to index or bound a memory buffer in the Extensions API, the resulting read operation accesses memory beyond the intended allocation boundary. The affected component spans all Chrome desktop versions captured under CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* prior to the 150.0.7871.115 boundary release. The Chromium issue tracker reference (https://issues.chromium.org/issues/515443146) likely contains additional technical detail but may be access-restricted pending broader patch adoption.
RemediationAI
Update Google Chrome to version 150.0.7871.115 or later via Chrome's built-in updater (chrome://settings/help) or via the vendor stable channel advisory at http://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_01162222768.html. Vendor-released patch: 150.0.7871.115. Prior to patching, enterprise administrators can restrict extension installation to an approved allowlist using Chrome enterprise policy (ExtensionInstallAllowlist / ExtensionInstallForcelist), preventing delivery of the malicious extension that is the prerequisite for exploitation; note this may impact productivity for users relying on unapproved extensions. Enabling Chrome's Enhanced Safe Browsing may flag known-malicious extensions during installation but is not a complete compensating control. Chromium-based browser users should monitor their respective vendors for patched releases tracking this upstream fix.
Same weakness CWE-190 – Integer Overflow or Wraparound
View allSame technique Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today