EUVD-2026-50631
GHSA-g3c9-mhvm-x87q
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Site isolation bypass crosses origin process boundaries implying S:C; extension install requires active user action (UI:R, PR:N); C:L added since cross-origin access likely exposes some data.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
5DescriptionCVE.org
Policy bypass in Extensions in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension to bypass site isolation via a crafted Chrome Extension. (Chromium security severity: Medium)
AnalysisAI
Policy bypass in the Extensions subsystem of Google Chrome (all versions prior to 151.0.7922.72) allows site isolation circumvention when a user is convinced to install a crafted malicious extension. The CVSS vector (I:H, S:U) and CWE-693 indicate this is a protection mechanism failure that undermines Chrome's cross-origin boundary enforcement, potentially enabling manipulation of content across isolated sites. No public exploit has been identified at time of analysis; EPSS at 0.12% (3rd percentile) reflects low current exploitation probability, and CISA KEV listing is absent.
Technical ContextAI
CWE-693 (Protection Mechanism Failure) identifies the root cause as an incomplete or bypassable enforcement of Chrome's extension policy controls. Chrome's site isolation architecture separates web origins into distinct renderer processes as a core defence against cross-site attacks such as Spectre and cross-origin data leakage. The Extensions API grants installed extensions elevated access to browser internals and tab content; when policy guards on that API are insufficient, a crafted extension can bridge isolated renderer processes and access origins it should not reach. The affected CPE (cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*) covers all Chrome desktop versions prior to 151.0.7922.72, with the issue tracked internally at Chromium issue 523637452 (currently access-restricted per standard disclosure practice).
RemediationAI
The primary fix is to update Google Chrome to version 151.0.7922.72 or later, available through Chrome's built-in auto-update mechanism or directly via the vendor advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. For enterprise environments that cannot immediately deploy the update, the most targeted compensating control is enforcing a Chrome Enterprise extension allowlist using the ExtensionInstallAllowlist and ExtensionInstallBlocklist policies, which prevents installation of any extension not explicitly approved - this directly eliminates the required attack precondition. The trade-off is operational overhead of maintaining the allowlist and potential friction for users who rely on unvetted extensions. Disabling developer mode sideloading via DeveloperToolsAvailability policy removes another installation vector. Generic network-layer controls are not applicable here, as the vulnerability is triggered post-installation.
Same weakness CWE-693 – Protection Mechanism Failure
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today