Executive brief
A security vulnerability in Google Chrome for Android could allow a malicious browser extension to bypass standard security boundaries. If a user is tricked into installing a specially crafted extension, the attacker could access or modify data from other websites the user visits. This could lead to the theft of sensitive information, such as login credentials or personal data, by circumventing the browser's Same Origin Policy.
Technical details
An inappropriate implementation in the Extensions component of Google Chrome on Android allowed for a Same Origin Policy (SOP) bypass. The vulnerability is triggered when a user installs a malicious, specially crafted Chrome Extension. By bypassing SOP, the extension can programmatically interact with and extract data from web origins it should not have access to. This issue affected versions prior to 150.0.7871.47 and has been addressed in the stable channel update. The attack requires user interaction to install the malicious extension but does not require high privileges beyond the extension's installation.
Affected products
- Google Chrome prior to 150.0.7871.47
Timeline
- 2026-05-14: disclosed: Reported to Chromium by Google internal researchers
- 2026-06-30: patched: Fixed in version 150.0.7871.47
- 2026-06-30: advisory