Executive brief
A vulnerability in Google Chrome's extension system could allow a malicious website to gain elevated privileges on a user's computer. This issue specifically affects users who have already had their browser's content rendering process compromised. If exploited, an attacker could bypass security boundaries to perform actions with higher authority than normally permitted, potentially leading to unauthorized access to browser data or settings.
Technical details
An inappropriate implementation vulnerability exists in the Extensions component of Google Chrome. The flaw allows a remote attacker who has already compromised the renderer process to achieve privilege escalation by enticing a user to visit a specially crafted HTML page. The vulnerability is categorized under CWE-20 (Improper Input Validation). By exploiting this weakness, an attacker can move from a restricted sandbox environment to a higher privilege level within the browser's extension framework. The issue is resolved in Google Chrome version 149.0.7827.53.
Affected products
- Google Chrome prior to 149.0.7827.53
Timeline
- 2026-06-02: patched: Chrome 149.0.7827.53 released to stable channel.
- 2026-06-05: disclosed: CVE published in NVD.