EUVD-2026-50770
GHSA-9c37-rj77-8q8m
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Extension distributed over network (AV:N), user must install it (UI:R), no prior auth needed (PR:N), impact is integrity-only navigation bypass with no confidentiality or availability consequence (I:H, C:N, A:N).
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
5DescriptionCVE.org
Insufficient policy enforcement in Extensions in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a crafted Chrome Extension. (Chromium security severity: Medium)
AnalysisAI
Navigation restriction bypass in Google Chrome's Extensions subsystem affects all desktop versions prior to 151.0.7922.72, enabling an attacker who convinces a user to install a crafted malicious extension to circumvent Chrome's navigation enforcement policies. The CWE-602 root cause indicates client-side policy logic can be subverted by a malicious extension actor, resulting in a high integrity impact with no confidentiality or availability exposure. No public exploit has been identified at time of analysis, and the EPSS score of 0.12% (2nd percentile) indicates very low exploitation probability, despite the CVSS 6.5 medium-severity rating.
Technical ContextAI
The vulnerability is rooted in CWE-602 (Client-Side Enforcement of Server-Side Security), meaning Chrome's extension policy enforcement mechanism fails to adequately validate or enforce navigation restrictions from the browser engine's trusted context, allowing a crafted extension to override or bypass those controls client-side. Chrome's Extensions system grants extensions declarative permissions and API access gated by policy; insufficient enforcement here means the policy boundary between trusted browser navigation logic and extension-controlled behavior is porous. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covering all Chrome desktop versions prior to 151.0.7922.72. The Chromium issue tracker reference (https://issues.chromium.org/issues/517597914) may contain additional technical detail, though the bug may be access-controlled.
RemediationAI
Update Google Chrome to version 151.0.7922.72 or later via the stable channel; this is a vendor-released patch as confirmed by the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. As a compensating control before patching, enterprise administrators should enforce extension allowlisting via Chrome group policies (ExtensionInstallAllowlist and ExtensionInstallBlocklist), restricting installation to vetted extensions only - note this will block user-initiated installation of unapproved extensions and may require an approval workflow that could affect productivity. In managed environments, disabling sideloading via the BlockExternalExtensions policy further reduces the attack surface. User awareness training on avoiding installation of unverified extensions provides a procedural layer but is not a technical substitute for patching.
Same technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today