Executive brief
A security vulnerability exists in Google Chrome's Extensions API, which is the system that allows users to add new features to their browser. If a user is tricked into installing a malicious extension, an attacker could gain unauthorized access to the browser's memory. This could potentially lead to the exposure of sensitive information handled by the browser.
Technical details
An integer overflow (CWE-190) exists within the Extensions API component of Google Chrome. The vulnerability is triggered when a user installs and executes a specially crafted malicious extension. This flaw allows the extension to bypass intended memory boundaries, resulting in an out-of-bounds memory read. An attacker could leverage this to access sensitive data residing in the browser's memory space. The issue is resolved in Google Chrome version 150.0.7871.115.
Affected products
- Google Chrome Prior to 150.0.7871.115
Timeline
- 2026-05-21: disclosed: Reported to Chromium by Google researchers
- 2026-07-08: patched: Fixed in stable channel update 150.0.7871.115
- 2026-07-08: advisory