Executive brief
Google Chrome is a widely used web browser. A vulnerability in the way Chrome handles browser extensions could allow a malicious extension to access data from other websites that it should not be able to see. To exploit this, an attacker would need to trick a user into installing a specifically crafted malicious extension, potentially leading to the exposure of sensitive personal or browsing information.
Technical details
An insufficient policy enforcement vulnerability exists in the Extensions component of Google Chrome. The flaw allows a crafted Chrome Extension to bypass cross-origin restrictions and leak data from other origins. Exploitation requires a user to install a malicious extension, typically through social engineering. Once installed, the extension can programmatically access data it is not authorized to reach under standard security policies. This issue is resolved in Chrome version 150.0.7871.47 and later.
Affected products
- Google Chrome prior to 150.0.7871.47
Timeline
- 2026-06-30: disclosed
- 2026-06-30: patched