CVE-2026-11062: Chrome Extension Policy Bypass Allows Script Injection

Technical summary

This vulnerability stems from insufficient policy enforcement in Chrome's extension sandboxing mechanism (CWE-602: Use of Hard-coded Password). A malicious Chrome extension can bypass content security policies and inject arbitrary JavaScript or HTML into privileged browser pages—those normally protected from script injection. The vulnerability affects Chrome on Windows, macOS, and Linux. The attack surface is limited by the requirement that a user must be socially engineered into installing the malicious extension; however, once installed, the attacker gains the ability to modify page rendering and potentially intercept or alter user interactions with sensitive web applications. Chromium rated this as Medium severity.

Business impact

Organizations using Chrome as a standard browser face risk if employees can be tricked into installing extensions from untrusted sources. Attackers could use this to inject phishing content, credential harvesters, or misleading information into legitimate websites—essentially a man-in-the-browser attack for pages rendered in Chrome. Financial services, SaaS platforms, and internal web applications are particularly at risk if the injected content is designed to capture user credentials or manipulate transactions. The impact is heightened in environments where users have elevated privileges or access to sensitive systems through web interfaces.

Affected systems

Google Chrome prior to version 149.0.7827.53 running on Windows, macOS, or Linux is vulnerable. This includes all Chrome-based Chromium distributions. The vulnerability does not appear in the published data to be specific to any particular enterprise or consumer version, suggesting all Chrome users below the patched version are in scope.

Exploitability

Exploitation requires user interaction—specifically, convincing a user to install a malicious extension. This typically involves social engineering (misleading extension store listings, typosquatting, phishing emails with download links, or compromised third-party extension repositories). Once installed, the extension executes with no additional user action needed. The attack vector is network-based and requires no special system privileges. The relatively low barrier to creating and distributing a Chrome extension, combined with the large user base, makes this vulnerability moderately exploitable in campaigns targeting specific organizations or user groups.

Remediation

Update Google Chrome to version 149.0.7827.53 or later. Chrome's auto-update mechanism typically deploys patches within days; however, verify deployment in your environment. Additionally, enforce policies to restrict extension installation—many organizations use Chrome policies (via Google Admin or third-party MDM solutions) to create an allowlist of approved extensions or to block installation entirely. Educate users on the risks of installing extensions from unknown sources and implement extension approval workflows if feasible.

Patch guidance

Google Chrome 149.0.7827.53 or later addresses this vulnerability. Confirm your current version in Chrome Settings > About Chrome (it will auto-update if newer versions are available). For managed deployments, verify the update is applied across your fleet using your organization's device management system. No other patching is required; the fix is contained in the Chrome browser update itself.

Detection guidance

Monitor for suspicious Chrome extension installations, particularly those installed from non-store sources or with unusual permissions (especially those requesting content script injection on privileged domains). Review Chrome extension audit logs if available through your MDM or browser management system. Look for extensions that request broad or unusual permissions, and cross-reference against your organization's approved extension list. On individual endpoints, users can view installed extensions at chrome://extensions. Consider canary deployments of the patched Chrome version to validate stability before broad rollout.

Why prioritize this

While this vulnerability carries a CVSS score of 4.3 (Medium), the social engineering barrier and requirement for user action reduce its attractiveness to widespread attackers. However, it poses a credible risk to targeted campaigns against organizations with high-value web applications or sensitive data accessible through browsers. It warrants prompt patching but is not critical; patching should be coordinated within your standard update cycle (typically weeks, not days, unless targeting a high-risk user group).

Risk score, explained

The CVSS 3.1 score of 4.3 reflects a network attack vector with low complexity and required user interaction, but limited impact (integrity only, no confidentiality or availability impact). The Medium severity designation aligns with Chromium's assessment. The score appropriately penalizes the social engineering requirement while crediting the ability to inject content into privileged pages, which could enable credential theft or transaction manipulation in specific attack scenarios.

Frequently asked questions