Executive brief
A security vulnerability in Google Chrome's extension system could allow a malicious extension to bypass Content Security Policy (CSP) protections. If an attacker convinces a user to install a specially crafted extension, they could circumvent security rules designed to prevent unauthorized code execution or data access on websites. This could lead to unauthorized actions being performed on behalf of the user or the exposure of sensitive information from web pages.
Technical details
This vulnerability is classified as insufficient policy enforcement within the Google Chrome Extensions framework. The flaw resides in how the browser enforces Content Security Policy (CSP) for installed extensions. An attacker can exploit this by tricking a user into installing a malicious, crafted extension. Once installed, the extension can bypass CSP restrictions that are intended to restrict the resources a page can load or execute. This bypass could facilitate cross-site scripting (XSS) or unauthorized data exfiltration. The issue is resolved in Chrome version 150.0.7871.47.
Affected products
- Google Chrome prior to 150.0.7871.47
Timeline
- 2026-06-30: disclosed
- 2026-06-30: advisory
- 2026-06-30: patched