EUVD-2026-50631
GHSA-g3c9-mhvm-x87q
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious Chrome extension exploiting policy bypass
-
DeliveryDistribute via phishing or Web Store submission
-
ExploitUser installs extension
-
ExecutionExtension API invokes policy bypass
-
PersistSite isolation boundary circumvented
-
ImpactManipulate or access cross-origin content
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V15 - Secure Coding and Architecture Protection mechanism completeness
|
| Exploitation Conditions | The singular and non-negotiable prerequisite is that the victim user must install the attacker-controlled Chrome extension - this is the UI:R condition in the CVSS vector and the central attack dependency. No special Chrome configuration, non-default settings, or elevated system privileges are required beyond the standard extension installation flow. The PR:N metric confirms the attacker needs no account or credentials on the victim's system. Factors that limit exploitation: Chrome Web Store automated and manual review creates friction for mass distribution; enterprise-managed Chrome instances with ExtensionInstallAllowlist policy block installation of unapproved extensions entirely; users who only install extensions from trusted, well-known publishers are not practically exposed; the attack does not affect Chrome instances with no extensions installed. |
| Impact | The CVSS 6.5 Medium score is driven by AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N, reflecting network-deliverable, low-complexity exploitation with no attacker privileges required but mandatory user interaction (installing the malicious extension). The integrity-only impact (I:H, C:N, A:N) and unchanged scope (S:U) assigned by the vendor may understate the cross-origin nature of a site-isolation bypass - bypassing process isolation boundaries arguably implies a changed scope (S:C); this discrepancy should be verified against the vendor's final advisory rationale. EPSS at 0.12% (3rd percentile) strongly indicates this is not currently being exploited opportunistically. The absence of a CISA KEV entry and no reported POC further reduce near-term urgency. Real-world risk is meaningful but not critical: the attack requires a social engineering step (extension installation), Chrome Web Store vetting adds friction, and enterprise deployments with extension allowlisting are largely unexposed. The primary risk profile is targeted attacks against users who can be manipulated into sideloading or installing a store-listed malicious extension. |
| Exploit ScenarioDerived | An attacker develops a Chrome extension that appears legitimate - a productivity tool, ad blocker, or theme - and distributes it via phishing email, a deceptive website, or by submitting it to the Chrome Web Store under a benign guise. Once a victim installs the extension, it invokes the policy bypass to cross Chrome's site isolation boundary, allowing the extension to manipulate or read content from origins (e.g., banking or corporate intranet sites) that the extension should have no access to. No public exploit code has been identified at time of analysis, meaning exploitation currently requires custom development capability. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 31, 2026
Policy bypass in the Extensions subsystem of Google Chrome (all versions prior to 151.0.7922.72) allows site isolation circumvention when a user is convinced to install a crafted malicious extension. The CVSS vector (I:H, S:U) and CWE-693 indicate this is a protection mechanism failure that undermines Chrome's cross-origin boundary enforcement, potentially enabling manipulation of content across isolated sites. No public exploit has been identified at time of analysis; EPSS at 0.12% (3rd percentile) reflects low current exploitation probability, and CISA KEV listing is absent.
RemediationAI
The primary fix is to update Google Chrome to version 151.0.7922.72 or later, available through Chrome's built-in auto-update mechanism or directly via the vendor advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. For enterprise environments that cannot immediately deploy the update, the most targeted compensating control is enforcing a Chrome Enterprise extension allowlist using the ExtensionInstallAllowlist and ExtensionInstallBlocklist policies, which prevents installation of any extension not explicitly approved - this directly eliminates the required attack precondition. The trade-off is operational overhead of maintaining the allowlist and potential friction for users who rely on unvetted extensions. Disabling developer mode sideloading via DeveloperToolsAvailability policy removes another installation vector. Generic network-layer controls are not applicable here, as the vulnerability is triggered post-installation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-693 (Protection Mechanism Failure) identifies the root cause as an incomplete or bypassable enforcement of Chrome's extension policy controls. Chrome's site isolation architecture separates web origins into distinct renderer processes as a core defence against cross-site attacks such as Spectre and cross-origin data leakage. The Extensions API grants installed extensions elevated access to browser internals and tab content; when policy guards on that API are insufficient, a crafted extension can bridge isolated renderer processes and access origins it should not reach. The affected CPE (cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*) covers all Chrome desktop versions prior to 151.0.7922.72, with the issue tracked internally at Chromium issue 523637452 (currently access-restricted per standard disclosure practice).
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Site isolation bypass crosses origin process boundaries implying S:C; extension install requires active user action (UI:R, PR:N); C:L added since cross-origin access likely exposes some data.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Policy bypass in Extensions in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension to bypass site isolation via a crafted Chrome Extension. (Chromium security severity: Medium)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-693 – Protection Mechanism Failure
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB