EUVD-2026-50689
GHSA-jxrj-j9xc-wfqg
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
UXSS implies cross-origin script injection beyond the extension's own scope, warranting S:C; all other metrics align with vendor assignment.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
5DescriptionCVE.org
Insufficient policy enforcement in Extensions in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension to inject arbitrary scripts or HTML (UXSS) via a crafted Chrome Extension. (Chromium security severity: Medium)
AnalysisAI
Insufficient policy enforcement in Google Chrome's Extensions subsystem prior to version 151.0.7922.72 enables Universal Cross-Site Scripting (UXSS), allowing an attacker who socially engineers a user into installing a malicious extension to inject arbitrary scripts or HTML across web origins. CVSS scores this at 4.2 (Medium) with high attack complexity reflecting the required social engineering; EPSS is negligible at 0.13% (3rd percentile). No public exploit code has been identified at time of analysis and this vulnerability is not listed in CISA KEV, suggesting it has not seen widespread or automated exploitation.
Technical ContextAI
The vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation, i.e., Cross-Site Scripting), but manifests as UXSS - a class of XSS that leverages browser-level privileges to bypass the Same-Origin Policy. Chrome's extension architecture grants extensions elevated content-script access to web pages; insufficient policy enforcement in how extensions interact with page contexts allows a malicious extension to inject arbitrary scripts or HTML into page origins it should not control. The affected component is the Extensions subsystem of Google Chrome, confirmed by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covering all platforms. UXSS is more severe than reflected XSS because it crosses origin boundaries within the browser, potentially affecting any open tab or page session, not just the site the extension targets.
RemediationAI
The primary fix is to update Google Chrome to version 151.0.7922.72 or later, which is confirmed as the patched release per the vendor advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome's auto-update mechanism will deliver this to most users automatically; administrators managing enterprise fleets should verify rollout via Chrome Browser Cloud Management or Group Policy and confirm the installed version is at or above 151.0.7922.72. As a compensating control prior to patching, organizations should enforce extension allowlisting via Chrome enterprise policy (ExtensionInstallAllowlist / ExtensionInstallBlocklist) to prevent installation of unapproved extensions - this directly blocks the prerequisite attack step and has the trade-off of requiring administrative overhead to maintain approved extension lists. Disabling developer mode extensions in managed environments also reduces sideloading risk.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today