Executive brief
Google Chrome, a widely used web browser, contained a vulnerability in its Extensions component. This flaw could allow a malicious website to bypass security boundaries and run unauthorized scripts or display fake content within the browser. If exploited, this could lead to the theft of sensitive information or unauthorized actions being performed on behalf of the user.
Technical details
A Universal Cross-Site Scripting (UXSS) vulnerability existed in the Extensions component of Google Chrome due to an inappropriate implementation. A remote attacker could exploit this by enticing a user to visit a specially crafted HTML page. Successful exploitation allows the attacker to bypass the Same-Origin Policy (SOP) and execute arbitrary JavaScript or inject HTML in the context of other websites or the browser itself. This issue was addressed in Google Chrome version 151.0.7922.72.
Affected products
- Google Chrome prior to 151.0.7922.72
Timeline
- 2026-07-29: patched: Fixed in Chrome Stable Channel Update 151.0.7922.72
- 2026-07-30: disclosed