EUVD-2026-50902
GHSA-pw8r-jwgp-h577
Severity by source
Sources disagree (Low–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
UI:R reflects mandatory social-engineering install step; I:L captures limited access control bypass; C:N and A:N confirmed by description and Chromium Low severity rating.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Insufficient policy enforcement in Extensions in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension to bypass discretionary access control via a crafted domain name. (Chromium security severity: Low)
AnalysisAI
Insufficient policy enforcement in the Extensions subsystem of Google Chrome prior to 151.0.7922.72 allows an attacker to bypass discretionary access controls by deploying a malicious extension that uses a specially crafted domain name. The attack is fully dependent on social engineering - the victim must be convinced to install the malicious extension, which significantly constrains opportunistic exploitation. With a CVSS score of 4.3, EPSS at 0.12% (2nd percentile), no CISA KEV listing, and a 'Low' Chromium-internal severity rating, no public exploit identified at time of analysis, this represents a minimal real-world priority for most organizations, particularly those with enterprise extension management controls in place.
Technical ContextAI
The vulnerability exists within Google Chrome's Extensions framework, specifically in the policy enforcement layer that governs what domains an extension is permitted to interact with. When a crafted domain name is processed by the extension permission system, the enforcement logic fails to apply the correct discretionary access controls, permitting the extension to exceed its intended permissions. The affected product is identified by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering all desktop platforms for Chrome versions prior to 151.0.7922.72. No CWE is formally assigned, but the root cause behaviorally aligns with CWE-863 (Incorrect Authorization) or CWE-184 (Incomplete List of Disallowed Inputs), given the domain-name-based trigger that bypasses a control list or policy check. Chrome's own internal severity classification rates this 'Low', consistent with the limited integrity-only impact and high exploitation friction.
RemediationAI
The primary remediation is to upgrade Google Chrome to version 151.0.7922.72 or later, as confirmed by the vendor stable channel advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome's auto-update mechanism will apply this for most consumer deployments, but administrators of managed environments should verify fleet-wide version compliance via endpoint management tooling. As a compensating control, organizations can enforce Chrome Enterprise policies such as ExtensionInstallBlocklist (set to '*' to block all) combined with ExtensionInstallAllowlist to restrict extension installation to vetted, approved extensions only - this eliminates the attack vector entirely by preventing the malicious extension from being installed, though the trade-off is reduced user autonomy in extension selection. No additional workarounds with significant operational trade-offs are necessary given the straightforward availability of the vendor patch.
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today