Executive brief
A vulnerability in Google Chrome's developer tools (DevTools) could allow a malicious browser extension to access sensitive information stored in the browser's memory. To exploit this, an attacker would first need to trick a user into installing a specifically crafted malicious extension. This could lead to the exposure of private data, though the overall risk is considered low by the manufacturer.
Technical details
This vulnerability is classified as an inappropriate implementation within the DevTools component of Google Chrome. The flaw allows a malicious Chrome Extension to bypass intended memory isolation boundaries to read sensitive information from the browser's process memory. Exploitation requires a prerequisite of user interaction, specifically convincing a target to install a malicious extension. Once installed, the extension can leverage the DevTools implementation flaw to extract data. Google has addressed this issue in Chrome version 149.0.7827.53.
Affected products
- Google Chrome prior to 149.0.7827.53
Timeline
- 2026-06-02: patched: Chrome 149.0.7827.53 released to stable channel
- 2026-06-05: disclosed: CVE published to NVD