Executive brief
A vulnerability in Google Chrome's DevTools component could allow a malicious browser extension to gain elevated privileges on a user's system. To exploit this, an attacker must first trick a user into installing a specially crafted extension. Successful exploitation could allow the attacker to bypass security boundaries within the browser, potentially compromising user data or browser settings.
Technical details
An improper input validation vulnerability (CWE-20) exists in the DevTools component of Google Chrome. The flaw stems from insufficient validation of untrusted input, which can be leveraged by a malicious Chrome Extension to achieve privilege escalation. An attacker must successfully entice a user to install a crafted extension to trigger the vulnerability. Once installed, the extension can exploit the DevTools interface to bypass intended security restrictions. This issue is resolved in Google Chrome version 151.0.7922.72 for Windows, Mac, and Linux.
Affected products
- Google Chrome prior to 151.0.7922.72
Timeline
- 2026-07-29: advisory: Google released a stable channel update addressing the issue.
- 2026-07-30: disclosed: NVD published the CVE record.