Executive brief
Google Chrome's extension system contained an information leak vulnerability that could allow an attacker to access sensitive cross-origin data through a malicious browser extension. By leveraging social engineering techniques to trick users into installing a crafted extension, an attacker could circumvent Chrome's security boundaries to steal data from other websites visited by the user. This vulnerability affects Chrome versions prior to 153.0.8010.36 and was patched in the September 2026 stable release.
Technical details
The vulnerability is classified as an information leak in Chrome's Extensions component, allowing a remote attacker to obtain cross-origin data through a specially crafted extension. The attack requires social engineering to convince a user to install the malicious extension, but once installed, the extension can access data from origins it should not have permission to access due to insufficient authorization controls. This bypasses Chrome's same-origin policy and extension permission model. The vulnerability was addressed in Chrome 153.0.8010.36 released on September 8, 2026, with a CVSS score of 4.3 (Medium severity).
Affected products
- Google Chrome prior to 153.0.8010.36
Timeline
- 2026-09-09: disclosed
- 2026-09-08: patched: Fixed in Chrome 153.0.8010.36