Executive brief
A vulnerability in Google Chrome's extension system could allow a remote attacker to gain elevated privileges. This issue occurs if an attacker has already partially compromised the browser's rendering process, allowing them to use a specially crafted webpage to bypass security restrictions. Successful exploitation could lead to unauthorized access to browser functions or user data beyond the normal sandbox limits.
Technical details
An improper input validation vulnerability (CWE-20) exists in the Extensions component of Google Chrome. The flaw allows a remote attacker to perform privilege escalation if they have already achieved code execution within a compromised renderer process. By enticing a user to visit a malicious HTML page, the attacker can exploit the insufficient validation to bypass security boundaries. Google has addressed this in version 151.0.7922.72. The vulnerability is classified by Chromium as Low severity.
Affected products
- Google Chrome prior to 151.0.7922.72
Timeline
- 2026-07-29: patched: Fixed in version 151.0.7922.72
- 2026-07-30: disclosed: NVD publication date