CVE-2026-11238: Chrome DevTools Memory Disclosure via Malicious Extension

Technical summary

The vulnerability stems from an inappropriate implementation in Chrome's DevTools architecture that fails to properly isolate or restrict what data a malicious extension can access from process memory. Specifically, a crafted Chrome Extension with the right permissions can leverage DevTools interfaces to read memory regions that should be protected. The issue maps to CWE-306 (Missing Authentication for Critical Function), indicating that memory access controls lack sufficient verification. The attack vector is network-adjacent (social engineering via malicious extension distribution), complexity is high due to the user-installation requirement, and impact is confidentiality loss without integrity or availability compromise.

Business impact

Memory disclosure vulnerabilities pose indirect but meaningful business risk. An attacker extracting process memory could potentially recover authentication tokens, API keys, session data, personal information in transit, or proprietary application state from browser processes. For organizations with strict data handling requirements or those subject to regulatory frameworks (HIPAA, PCI-DSS, GDPR), such leaks create compliance violations and potential liability. The requirement for user trust—installing an extension—makes this most dangerous in environments with inadequate security awareness or where users are targeted by convincing social engineering campaigns.

Affected systems

The vulnerability affects Google Chrome on Windows, macOS, and Linux systems running versions prior to 149.0.7827.53. It is technically cross-platform because the flaw resides in Chrome's core DevTools implementation. The attack surface is limited to users who can be persuaded to install an untrusted or spoofed Chrome extension, making targeted users and those with permissive extension policies at highest risk.

Exploitability

Exploitability is constrained by user interaction requirements: the attacker must successfully convince or trick a user into installing a malicious extension. This is not a zero-click or zero-user-interaction flaw. However, once installed, the malicious extension operates with relatively straightforward access to DevTools memory-inspection capabilities. The high-complexity CVSS rating reflects these barriers, but determined adversaries using social engineering, typosquatting, or compromised distribution channels can overcome them. The vulnerability is not currently tracked in the CISA Known Exploited Vulnerabilities catalog, indicating no in-the-wild weaponization has been publicly documented at the time of publication.

Remediation

Patch to Google Chrome 149.0.7827.53 or later immediately. This update corrects the DevTools implementation to properly restrict extension access to process memory. Additionally, organizations should reinforce security awareness training on extension installation risks, enforce extension allowlisting policies where feasible, and monitor for suspicious extension installations in audit logs. Users should review installed extensions regularly and remove anything unfamiliar or unnecessary.

Patch guidance

Google has released Chrome version 149.0.7827.53 containing the fix. Users on Windows, macOS, and Linux should update as soon as possible. Chrome's auto-update mechanism will push the patch automatically for most users, but verify successful installation by checking Settings > About Google Chrome. Enterprise administrators should test the patch in a staging environment and deploy via Chrome Enterprise policies to ensure compatibility with internal workflows and extensions before rolling out to production.

Detection guidance

Monitor for suspicious Chrome extension installations—particularly those from unknown publishers or with unusual permission requests. In security logs, track extension installation events and flag any that request excessive permissions, especially those with 'webRequest' or 'scripting' capabilities combined with broad URL patterns. Memory-access anomalies (high entropy reads from process memory via extensions) may indicate exploitation attempts, though direct detection is difficult. Endpoint detection and response (EDR) tools should flag unexpected child processes or unusual memory manipulation from Chrome subprocesses. Consider blocking third-party or untrusted extension sources via Group Policy or MDM policies.

Why prioritize this

While not in active exploitation and carrying Chromium's internal 'Low' severity rating, the CVSS score of 5.9 (MEDIUM) combined with memory-disclosure impact justifies near-term patching. The practical barrier—requiring user installation of a malicious extension—reduces urgency compared to remotely exploitable flaws, but organizations with high-value targets, strict compliance requirements, or users handling sensitive data should prioritize this update. The low effort required by attackers post-installation and the sensitive nature of memory contents warrant timely remediation within standard patch cycles.

Risk score, explained

The CVSS 3.1 score of 5.9 (MEDIUM) reflects a confidentiality-only impact (high) tempered by high attack complexity and the need for user interaction (no privileges required, no special system configuration needed, but convincing installation of a malicious extension is a significant real-world hurdle). The vector notation AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N indicates network-adjacent attack vector, high complexity, no privilege prerequisite, no user interaction after installation, unchanged scope, and high confidentiality impact with no integrity or availability loss. This is a classic data-disclosure vulnerability with a friction-dependent exploitation model.

Frequently asked questions