Executive brief
Google Chrome contains an improper privilege management vulnerability in its Regional Capabilities feature that allows attackers to bypass system access restrictions through social engineering. An attacker could craft a malicious Chrome extension that, when installed by a user, grants unauthorized access to restricted system features and user data, potentially compromising device security and user privacy.
Technical details
This vulnerability involves improper privilege management in Chrome's Regional Capabilities component, allowing attackers to bypass system access restrictions. The root cause lies in insufficient authorization checks within the Regional Capabilities feature when processing requests from Chrome extensions. An attacker must leverage social engineering to convince a user to install a crafted malicious extension; no authentication bypass or network exploitation alone is sufficient. Once the extension is installed, the lack of proper privilege validation allows the attacker to escalate privileges and access restricted system-level capabilities. The vulnerability is fixed in Chrome 152.0.7977.65 and later versions.
Affected products
- Google Chrome prior to 152.0.7977.65
Timeline
- 2026-08-25: disclosed: Published in Chrome Security Releases