EUVD-2026-50648
GHSA-635j-7735-7jm2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious Chrome extension
-
DeliverySocial-engineer user to install
-
ExploitBypass DevTools policy enforcement
-
ExecutionEscalate extension privileges in browser
-
ImpactAccess privileged browser capabilities
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V15 - Secure Coding and Architecture Protection mechanism completeness
|
| Exploitation Conditions | Exploitation requires that the victim be convinced to install an attacker-crafted Chrome extension - that malicious-extension installation is the concrete, mandatory precondition stated in the description, not an incidental detail. The bug then abuses insufficient policy enforcement in the DevTools component to escalate the extension's privileges. Limiting factors: it needs user interaction (UI:R - the user must accept/install the extension), it is not exploitable purely remotely without that install step despite AV:N, and it affects only Chrome desktop builds before 151.0.7922.72. Environments that block or allowlist extension installation via enterprise policy substantially neutralize the attack path. |
| Impact | Signals conflict and should be weighed carefully. The reported CVSS 3.1 base score is 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), which reads as high severity, yet Google/Chromium independently rated the security severity as Low, and no EPSS score or SSVC decision data was supplied. The CVSS vector marks PR:N (no prior privileges) but the description makes clear the real precondition is that a user must be tricked into installing a malicious extension (captured by UI:R) - so 'no privileges' overstates how trivially this is reached in practice. There is no KEV listing and no POC referenced, so this is not evidence of active or imminent exploitation. Net: the raw 8.8 overstates real-world urgency for most fleets; the vendor's Low rating plus the mandatory malicious-extension-install precondition point to a targeted, lower-probability threat rather than a mass-exploitable network vulnerability. Because a patch already ships in the stable channel, routine Chrome auto-update effectively closes it - verify the Chromium Low rating against your own extension-governance posture. |
| Exploit ScenarioDerived | An attacker publishes or sideloads a crafted Chrome extension and social-engineers a victim (e.g., via a fake productivity add-on or a phishing lure) into installing it. Once loaded, the extension abuses the insufficient DevTools policy enforcement to escalate its privileges within the browser beyond what its manifest permissions should allow. No public POC is referenced, and the attack hinges on the user actually completing the extension install. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Privilege escalation in Google Chrome's DevTools component (all desktop builds prior to 151.0.7922.72) lets a malicious browser extension bypass DevTools policy enforcement to gain capabilities beyond its declared permissions. Exploitation is not remote-in-a-vacuum: an attacker must first convince a victim to install a crafted extension, after which the flaw escalates that extension's effective privileges within the browser. Google fixed the issue in the stable channel and rated the Chromium security severity as Low; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
RemediationAI
Vendor-released patch: Google Chrome 151.0.7922.72 (stable channel). Update Chrome to 151.0.7922.72 or later - for most users Chrome's automatic update mechanism applies this after a browser restart, so ensure clients are restarted and that managed/enterprise auto-update is not disabled; the advisory is https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Because exploitation requires installing a malicious extension, an effective compensating control until patched is to restrict extension installation via enterprise policy: set ExtensionInstallBlocklist to '*' and use ExtensionInstallAllowlist to permit only vetted extension IDs (side effect: users can no longer self-install extensions, which may disrupt legitimate workflows), and/or force-install only approved extensions via ExtensionInstallForcelist. Auditing already-installed extensions and removing untrusted ones further reduces exposure. Chromium-based browsers should be updated to the build that incorporates the corresponding upstream fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability lives in Chrome's DevTools subsystem, which exposes powerful debugging and inspection APIs (the Chrome DevTools Protocol) that are normally gated by policy checks so that untrusted extension code cannot reach privileged surfaces. The root cause is classed as CWE-693 (Protection Mechanism Failure): a security control that is supposed to enforce a policy boundary is insufficiently applied, allowing a crafted extension to reach DevTools functionality it should not. The affected product per CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* - i.e. the Google Chrome desktop application across versions below the fixed build - and the same Chromium engine underlies other Chromium-based browsers that consume the upstream fix. Because the abused surface (DevTools) is an intended, always-present part of the browser rather than an optional feature, the weakness is about a missing/weak enforcement check rather than a memory-safety defect.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Low–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack requires a locally installed malicious extension and user interaction (AV:L, UI:R); it crosses the extension privilege boundary (S:C) but yields limited privilege escalation consistent with the vendor's Low rating, so C/I:L, A:N.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Insufficient policy enforcement in DevTools in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension to perform privilege escalation via a crafted Chrome Extension. (Chromium security severity: Low)
Executive ViewAI
Google Chrome DevTools privilege escalation (CVE-2026-17899, CVSS 8.8) enables malicious browser extensions to exceed their declared permissions once installed by users, potentially exposing sensitive development data and credentials. While the vulnerability requires social engineering to succeed rather than remote exploitation, it poses significant risk to developer and technical staff populations who routinely use extensions and DevTools for daily work.
Vendor-released patch: version 151.0.7922.72 or later.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Related Vulnerabilities in Google Chrome 151 Security Vulnerabilities
View all 80Same weakness CWE-693 – Protection Mechanism Failure
View allSame technique Privilege Escalation
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB