Google Chrome EUVD-2026-50735

Exploitation requires the victim to install an attacker-crafted Chrome Extension (UI:R) - this is the explicit, mandatory prerequisite from the description, not an optional configuration. The malicious extension must then feed crafted untrusted input to the DevTools component to trigger the CWE-20 validation gap and escalate privilege. Limiting factors: the attack cannot succeed against a user who does not install the malicious extension, so it depends on successful social engineering or side-loading; enterprises that enforce extension allowlisting or block non-Web-Store installs materially reduce exposure. Affected only on Chrome desktop versions below 151.0.7922.72. CVSS marks PR:N (no pre-existing privileges) but note the practical barrier of getting the extension installed is significant.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 8.8) rates this High, but the single most important limiting signal is buried in the description rather than the vector: successful exploitation requires the victim to install a malicious extension. That is a substantial social-engineering and delivery prerequisite that the UI:R metric only partially reflects - in practice the barrier is higher than a typical drive-by web bug, so raw 8.8 overstates opportunistic exploitability. Chromium classified the security severity as Medium, which is consistent with this reasoning and contrasts with the NVD-style 8.8 High. There is no EPSS score, no SSVC decision, no KEV listing, and no evidence of public exploit code in the provided data, so this is best treated as a real-but-not-emergency issue: patch promptly given Chrome's footprint, but there is no signal of active or automatable mass exploitation. Note the conflict to verify: PR:N implies no privileges, yet exploitation depends on the user actively installing attacker-supplied code - verify scope with Google's advisory.

An attacker publishes or side-loads a Chrome extension crafted to abuse the DevTools input-validation flaw and lures a victim into installing it (e.g., a fake productivity or theme extension). Once installed and run, the extension supplies crafted untrusted input to DevTools to escalate its privileges beyond the granted extension scope, giving the attacker high-impact control over the browser session and data. No public exploit code was identified at time of analysis, and the requirement for a user to install the extension (UI:R) is the main gating condition.