Executive brief
A vulnerability in Google Chrome's extension system allowed attackers to manipulate the address bar (Omnibox) using a malicious webpage. This could be used to trick users into believing they are on a legitimate website, such as a bank or login portal, when they are actually on a fraudulent site. This type of spoofing is a common tactic for phishing attacks aimed at stealing user credentials or sensitive information.
Technical details
An improper input validation vulnerability (CWE-20) exists in the Extensions component of Google Chrome. By leveraging a specially crafted HTML page, a remote attacker could bypass validation checks to spoof the contents of the Omnibox (URL bar). This flaw allows for the presentation of a deceptive URL, facilitating sophisticated phishing attacks. The vulnerability was addressed in Chrome version 150.0.7871.182 for Windows and Mac, and 150.0.7871.181 for Linux. Exploitation requires the victim to visit a malicious website but does not require specific extension permissions.
Affected products
- Google Chrome prior to 150.0.7871.182
Timeline
- 2026-06-02: disclosed: Reported to Google internally
- 2026-07-21: patched: Fixed in stable channel update 150.0.7871.182
- 2026-07-21: advisory