Executive brief
A vulnerability in Google Chrome's extension system could allow a malicious extension to escape the browser's security sandbox. To exploit this, an attacker must first trick a user into installing a specially crafted extension. If successful, the attacker could potentially gain unauthorized access to the user's underlying operating system or sensitive data outside of the browser's restricted environment.
Technical details
An improper input validation vulnerability (CWE-20) exists in the Extensions component of Google Chrome. The flaw allows a crafted Chrome Extension to bypass sandbox restrictions if a user is convinced to install it. This sandbox escape could allow an attacker to execute code outside of the browser's isolated process environment. The issue is addressed in Google Chrome version 151.0.7922.72.
Affected products
- Google Chrome prior to 151.0.7922.72
Timeline
- 2026-07-29: patched: Fixed in Chrome version 151.0.7922.72
- 2026-07-30: disclosed: NVD publication date