Executive brief
A vulnerability in Google Chrome's developer tools (DevTools) could allow a malicious browser extension to bypass security restrictions. If a user is tricked into installing a specially crafted extension, the attacker could force the browser to navigate to restricted or unauthorized web addresses. This could be used to circumvent internal security controls or facilitate further attacks on the user's browsing session.
Technical details
An improper input validation vulnerability (CWE-20) exists in the DevTools component of Google Chrome. The flaw stems from insufficient sanitization of inputs processed by DevTools when interacting with Chrome Extensions. A local attacker can exploit this by convincing a user to install a malicious extension. Once installed, the crafted extension can leverage DevTools to bypass browser navigation restrictions, potentially accessing internal or restricted URLs that should be blocked. This issue was resolved in Chrome version 149.0.7827.53.
Affected products
- Google Chrome prior to 149.0.7827.53
Timeline
- 2026-06-02: patched: Chrome 149.0.7827.53 released to stable channel.
- 2026-06-04: disclosed: CVE published.