EUVD-2026-50853
GHSA-74qq-x56m-pf89
Severity by source
Sources disagree (Low–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
AV:N for remotely delivered extension; UI:R for mandatory installation step; PR:N as attacker needs no prior access; C:L for limited cross-origin data leakage with no integrity or availability impact.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
5DescriptionCVE.org
Insufficient policy enforcement in DevTools in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension to leak cross-origin data via a crafted Chrome Extension. (Chromium security severity: Low)
AnalysisAI
DevTools policy enforcement failure in Google Chrome prior to 151.0.7922.72 enables cross-origin data leakage through a malicious Chrome Extension that a victim is socially engineered into installing. The vulnerability is classified as information disclosure only (C:L/I:N/A:N), requires active user participation to exploit, and carries Chromium's lowest internal severity rating. No public exploit code exists and no active exploitation has been identified; EPSS places this at the 2nd percentile, and SSVC confirms exploitation status as none with non-automatable delivery.
Technical ContextAI
The vulnerability resides in Google Chrome's DevTools component - the built-in browser developer tooling used for debugging, inspection, and profiling. CWE-346 (Origin Validation Error) identifies the root cause as a failure to properly enforce same-origin or cross-origin isolation policies within DevTools. Chrome Extensions operate within a sandboxed privilege model, but DevTools APIs exposed to extensions apparently contain a policy gap that allows a crafted extension to read data from origins it is not authorized to access, violating the browser's cross-origin resource isolation guarantees. The CPE string cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* indicates all Chrome versions across all platforms are affected below the fix version, and the EUVD-2026-50853 entry corroborates the version boundary at 151.0.7922.72.
RemediationAI
Upgrade Google Chrome to version 151.0.7922.72 or later via the stable channel, as documented at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome's auto-update mechanism handles this for most consumer deployments, but enterprise administrators should verify fleet-wide deployment through Google Admin Console, Microsoft Intune, SCCM, or equivalent endpoint management tooling. As a compensating control where immediate patching is not feasible, enforce Chrome extension installation allowlisting via Group Policy (ExtensionInstallAllowlist / ExtensionInstallBlocklist) or Google Workspace admin settings - this directly eliminates the attacker's delivery mechanism by preventing unapproved extension installation. The trade-off is administrative overhead to maintain the allowlist, but this control has no functional impact on typical end-user workflows and aligns with broader browser hardening best practices.
Same weakness CWE-346 – Origin Validation Error
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today