Google Chrome EUVD-2026-50853

Exploitation requires that the victim actively installs a malicious Chrome Extension crafted by the attacker - this is the critical, non-negotiable prerequisite. The CVSS vector confirms no authentication or existing privileges are required on the attacker side (PR:N), but mandatory user interaction (UI:R) means the attack cannot proceed without the victim completing the extension installation step. The DevTools policy bypass is exercised by the extension after installation, requiring no further action from the user. Exploitation is limited by: (1) the mandatory user interaction to install the extension, making automation impossible per SSVC; (2) Chrome Web Store review processes that may detect and remove malicious extensions; (3) enterprise Group Policy or Google Workspace extension allowlisting, which directly prevents unapproved extension installation; and (4) Chromium's own Low internal severity rating, indicating the Chrome security team assessed limited practical exploitability. No special network configuration, server-side exposure, or non-default browser settings are required beyond the extension installation itself.

Real-world risk is genuinely low despite Chrome's ubiquitous deployment footprint. CVSS scores this 4.3 (Medium) with AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N - while network-reachable, exploitation mandates active user interaction and yields only limited confidentiality impact. EPSS at 0.11% (2nd percentile) provides strong probabilistic confirmation that exploitation is rare in practice. SSVC aligns precisely: Exploitation: none, Automatable: no (the social engineering prerequisite structurally prevents mass automation), Technical Impact: partial. The CVE is absent from CISA KEV and no POC has been published. The two-step attack chain - delivering a malicious extension AND convincing the user to install it - is a meaningful friction point that separates this from opportunistic exploitation. For enterprises with Chrome extension allowlisting policies already enforced, the effective risk is near zero. For unmanaged consumer deployments, patching via Chrome's auto-update mechanism is the primary control. No conflicting signals exist in the available data.

An attacker publishes a malicious Chrome extension to the Web Store disguised as a productivity tool, or distributes it directly via a phishing campaign. A victim installs the extension, which then invokes DevTools APIs to read authenticated cross-origin content - such as page data from a logged-in web application open in another tab - and exfiltrates it to an attacker-controlled server. No public POC is available, and the installation prerequisite limits this to targeted social engineering rather than opportunistic mass exploitation.