Executive brief
A vulnerability in Google Chrome's extension system could allow a malicious extension to bypass security restrictions. If a user is persuaded to install a specially crafted extension, the attacker could circumvent Content Security Policy (CSP) protections, which are designed to prevent unauthorized code execution and data theft. This could lead to unauthorized actions being performed on behalf of the user within the browser.
Technical details
A vulnerability classified as insufficient policy enforcement existed in the Extensions component of Google Chrome. The flaw allowed a crafted Chrome Extension to bypass Content Security Policy (CSP) protections. To exploit this, an attacker must first convince a user to install a malicious extension. Once installed, the extension can circumvent security headers intended to restrict resource loading and script execution. This issue was addressed in Chrome version 149.0.7827.53.
Affected products
- Google Chrome prior to 149.0.7827.53
Timeline
- 2026-06-02: patched: Chrome 149.0.7827.53 released to stable channel
- 2026-06-05: disclosed: CVE published to NVD