CVE-2026-12456: Chrome Extension Same-Origin Policy Bypass – Patch to 149.0.7827.155

Technical summary

CVE-2026-12456 is an inappropriate implementation vulnerability in Chrome's extension security model affecting versions prior to 149.0.7827.155. The flaw resides in how the browser validates and enforces same-origin policy (SOP) constraints on extension-based requests, enabling a malicious extension to craft requests that bypass SOP protections. The vulnerability is classified as CWE-20 (Improper Input Validation), indicating insufficient vetting of extension capabilities or request origins. Chromium's internal severity assessment is High, though the CVSS v3.1 score of 4.2 (Medium) reflects the requirement for user interaction (extension installation) and the bounded scope of impact (confidentiality and integrity of single-origin data, no availability impact).

Business impact

The primary business risk stems from credential and session theft. A malicious extension installed by a user could harvest authentication tokens, read emails, or modify account settings on web services accessed during the same browser session. For enterprises, this poses a supply-chain threat if employees install extensions from untrusted sources or if legitimate extension stores become compromised. Data exfiltration risk is moderate because the attacker is confined to data accessible within the user's authenticated sessions. The requirement for user installation significantly reduces blast radius compared to network-based exploits.

Affected systems

The vulnerability affects Google Chrome versions prior to 149.0.7827.155 across Windows, macOS, and Linux environments. The CWE and vendor list indicate the flaw resides in the Chrome browser itself, not in the operating systems listed; those are affected only insofar as they run vulnerable Chrome versions. Users on any platform running Chrome 149.0.7827.155 or later are protected. Extended-support or legacy Chrome branches (e.g., Chromium derivatives) may have different patch timelines—verify against vendor advisories.

Exploitability

Exploitation requires social engineering: an attacker must convince a user to install a malicious extension from an untrusted source. The CVSS metric AC:H (Attack Complexity: High) and UI:R (User Interaction: Required) reflect this friction. Once installed, however, triggering the bypass is likely straightforward—no special user action beyond normal browsing is needed. The barrier to exploitation is not technical sophistication but social trust. Malicious extensions distributed via third-party app stores or phishing campaigns would be the typical delivery vector. No public exploit code or KEV designation exists, indicating this is not currently exploited in the wild at scale.

Remediation

Immediate remediation is upgrading Chrome to version 149.0.7827.155 or later. Google has patched the underlying extension validation logic. Organizations should enforce Chrome auto-update policies to ensure users do not remain on vulnerable versions. Additionally, implement extension management policies (e.g., via Chrome Enterprise) to restrict which extensions users can install, ideally allowlisting only trusted extensions or disabling third-party installation entirely. User awareness training on extension risks—emphasizing that extensions can access sensitive data—is a complementary control.

Patch guidance

Deploy Chrome 149.0.7827.155 or later. For managed environments, use Chrome Enterprise policies (ExtensionInstallBlocklist, ExtensionInstallAllowlist) to prevent installation of untrusted extensions. For individual users, enable auto-update if not already active (chrome://settings/help) and periodically audit installed extensions. Verify patch deployment via chrome://version to confirm the installed version meets or exceeds 149.0.7827.155.

Detection guidance

Detection is challenging because the vulnerability requires extension installation first. Monitor for suspicious extension installations via browser logs (Chrome enterprise logging or EDR tools that hook browser processes) or by auditing the extensions directory (%LOCALAPPDATA%\Google\Chrome\User Data\Default\Extensions on Windows, ~/Library/Application Support/Google/Chrome/Default/Extensions on macOS). Behavioral detection: watch for extensions making cross-origin requests to sensitive domains (mail, banking, SSO providers). Network detection is limited—the traffic appears legitimate because it originates from the user's authenticated session. EDR solutions that monitor process and network behavior may flag anomalous extension activity.

Why prioritize this

Prioritize this vulnerability for patching, but not as an emergency. The CVSS score of 4.2 (Medium) and lack of public exploitation reduce immediate urgency. However, the practical impact—credential theft via installed malware—is significant for organizations with high-value accounts or sensitive web services. Enterprises with strict BYOD or extension-management policies face lower risk. Prioritize patching for users who frequently install extensions or operate in social-engineering-prone environments (e.g., open-source communities, shared development machines). Align patching with your normal Chrome update cycle (typically weekly auto-updates), but do not delay if you detect suspicious extension activity in your environment.

Risk score, explained

The CVSS 4.2 reflects a bounded attack surface: user interaction (extension installation) is mandatory, and impact is limited to confidentiality and integrity within a single origin (no system availability or privilege escalation). The High Chromium severity rating acknowledges the real-world danger of credential theft but is tempered by the social-engineering requirement. For risk prioritization, consider environmental factors: organizations with extension controls or security-aware users face lower risk than those with permissive extension policies.

Frequently asked questions