CVE-2026-10997: Chrome Extension Policy Bypass Vulnerability (149.0.7827.53)

Technical summary

CVE-2026-10997 stems from insufficient policy enforcement in Chrome's extension subsystem. The vulnerability allows a malicious extension to circumvent discretionary access control mechanisms through a crafted extension manifest or payload. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) reflects network-based delivery with user interaction required, high integrity impact, and no confidentiality or availability impact. The underlying weakness is classified as CWE-732 (Incorrect Permission Assignment for Critical Resource).

Business impact

An attacker exploiting this vulnerability could modify or inject content, manipulate user data within the browser, or alter security-sensitive settings without appropriate permission warnings. Organizations relying on Chrome extension policies for security posture or compliance enforcement may find those controls bypassed. The attack requires user trust (convincing installation), but once established, the damage scope includes integrity of browsing sessions and potentially sensitive data manipulation.

Affected systems

All Google Chrome installations prior to version 149.0.7827.53 are affected. This includes Chrome on Windows, macOS, Linux, and Android platforms where extensions are supported. Users of Chromium-based browsers that incorporate the vulnerable code may also be affected; verify with your specific vendor.

Exploitability

Exploitability is straightforward from a technical standpoint but limited by social engineering requirements. An attacker must persuade the user to install a malicious extension, which may occur through deceptive packaging, bundling with legitimate tools, or supply chain compromise of an extension repository. Once installed, no further user action is needed for the vulnerability to be exploitable.

Remediation

Update to Google Chrome 149.0.7827.53 or later. Organizations should enforce automatic updates where feasible and audit currently installed extensions for suspicious behavior or unusual permission requests. Review extension allow-lists and consider restricting extension installation to curated catalogs.

Patch guidance

Apply Chrome version 149.0.7827.53 or later through standard update mechanisms. Most users can enable automatic updates in Chrome settings (Settings > About > Check for Updates). Enterprise deployments should use Google Admin Console or equivalent management tools to push and verify the patch across endpoints. Verify patch application by checking Settings > About > Google Chrome to confirm the installed version.

Detection guidance

Monitor for extensions installed outside official channels or with unusual permissions (particularly those requesting broad content script access, all-hosts permissions, or access to sensitive APIs). Behavioral indicators include unexplained network traffic from the browser process, unintended content injection, or changes to browser settings. Log extension installation events and periodically audit the extension list against organizational policy.

Why prioritize this

Although rated MEDIUM (CVSS 6.5), this vulnerability merits prompt attention because it directly undermines browser security policy enforcement—a foundational control for many organizations. The integrity impact is high, and the attack surface includes any employee who may be socially engineered. Prioritization should be HIGH in security-conscious environments and MEDIUM elsewhere.

Risk score, explained

The CVSS 6.5 MEDIUM rating reflects the requirement for user interaction (lowering severity) balanced against high integrity impact and low attack complexity. The vector shows no network-level authentication or privilege escalation needed, but the extension must reach the user's system and be installed. The lack of confidentiality or availability impact prevents a higher score, though integrity compromise of the browser environment is significant.

Frequently asked questions