CVE-2026-11267: Chrome Content Security Policy Bypass via Malicious Extensions

Technical summary

CVE-2026-11267 represents a policy enforcement gap in the Chrome Extensions API prior to version 149.0.7827.53. The vulnerability allows a crafted extension to circumvent content security policy restrictions, which are a primary defense mechanism preventing inline script execution and unauthorized resource loading. The issue is classified under CWE-602 (Client-Side Enforcement of Server-Side Security), indicating that CSP validation occurs in the browser rather than being enforced at a system level. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) reflects network accessibility, low attack complexity, no privilege requirement, required user interaction, and limited integrity impact with no confidentiality or availability impact.

Business impact

The practical business risk depends on deployed extension security posture. For organizations using CSP as a defense against malicious script injection, a compromised extension bypassing these controls could enable unauthorized modifications to web content, credential harvesting, or malware injection within the browser context. However, the requirement for active user installation limits blast radius compared to browser-engine-level flaws. The impact is primarily on data integrity rather than confidentiality or availability, making this a concern for environments handling sensitive transactions or where extension governance is weak.

Affected systems

Google Chrome versions prior to 149.0.7827.53 are affected. The vulnerability impacts Chrome on all major operating systems listed: Windows, macOS, and Linux. The presence of Linux kernel in the vendor list suggests the issue may affect Chromium-based browsers on Linux distributions as well. Any user running an unpatched Chrome version who installs a malicious extension remains at risk.

Exploitability

Real-world exploitation requires convincing a user to install a malicious extension—a social engineering requirement that prevents automated, large-scale attacks. An attacker would typically distribute the extension through deceptive means (fake stores, phishing, compromised websites) or by compromising a legitimate extension's codebase. Once installed, the extension gains persistent access to bypass CSP, making it a post-compromise attack rather than a zero-click vulnerability. The attack complexity is low once installation occurs, but the user interaction barrier significantly limits opportunistic exploitation.

Remediation

Update Google Chrome to version 149.0.7827.53 or later. The patch restores proper policy enforcement in the extension framework. Organizations should verify this version number against official Google Chrome release notes before deployment. In addition to patching, security teams should implement extension management policies to restrict installation of unsigned or unverified extensions, conduct security awareness training on extension installation risks, and consider using Chrome Enterprise policies to enforce CSP compliance across managed devices.

Patch guidance

Deploy Chrome version 149.0.7827.53 or later through your standard browser update mechanism. For managed environments, use Chrome Enterprise policy to enforce automatic updates or to block extension installation entirely unless whitelisted. Verify the version number in Chrome's Settings > About page (which displays the current version and triggers automatic updates). Test patches in a non-production environment to confirm compatibility with critical web applications or extensions before full rollout. If you manage a Chromium-based browser other than Chrome, check with your vendor for equivalent patch versions.

Detection guidance

Monitor for installation of unsigned, unusual, or suspicious Chrome extensions in your environment. Network detection is limited to observing extension manifest requests or downloads from non-standard sources. Endpoint detection can leverage Chrome policy logging (if Enterprise policies are enabled) to track extension installations. Look for extensions requesting excessive permissions, particularly network access or content script injection capabilities. Review browser security logs for CSP violations that suddenly cease after a specific date, which may indicate a previously-bypassed CSP becoming enforced post-patch. Enterprise customers can use Chrome management console to audit installed extensions across the fleet.

Why prioritize this

While the Chromium severity is Low, the CVSS score of 4.3 (Medium) warrants attention because the vulnerability directly impacts web security controls (CSP) that many organizations rely on. The social engineering requirement prevents panic-level prioritization, but the ease of exploitation once an extension is installed and the integrity impact justify prompt patching. Prioritize remediation for staff-facing systems and users who frequently install browser extensions, and defer slightly for restricted environments where extension installation is already controlled.

Risk score, explained

The CVSS 3.1 score of 4.3 reflects a Medium severity due to the combination of low attack complexity, no privilege or authentication requirement, user interaction (extension installation), and integrity-only impact. The score is calibrated between Low (where the Chromium maintainers initially assessed it) and High because CSP bypass is meaningful in scope but limited in confidentiality or availability impact. The integrity rating accounts for potential content modification and unauthorized script injection, while the lack of confidentiality or availability impact prevents a higher score. This sits squarely in the MEDIUM range, distinguishing it from both minor policy issues and critical control escapes.

Frequently asked questions