CVE-2026-13791: Chrome Malicious Extension Code Execution – Patch 150.0.7871.47

Technical summary

The vulnerability exists in Chrome's Downloads module due to improper input validation (CWE-20) when processing extension payloads. The attack vector requires network access and social engineering (user must install a malicious extension), but once the malicious extension is installed, arbitrary code execution occurs without further user interaction. The CVSS 3.1 vector (8.1 HIGH) reflects network-based delivery, high complexity due to user installation requirement, but high impact across confidentiality, integrity, and availability. Chrome versions before 150.0.7871.47 on Windows, macOS, and Linux are vulnerable.

Business impact

Successful exploitation could allow an attacker to execute arbitrary code within the Chrome sandbox context, potentially leading to data exfiltration, credential theft, malware installation, or lateral movement into the host system. The social engineering requirement (convincing a user to install a malicious extension) limits blast radius compared to zero-click exploits, but organizations with users who install untrusted extensions face significant risk. Extensions often request broad permissions and operate with elevated privileges, making this a stepping stone to system compromise.

Affected systems

Google Chrome versions prior to 150.0.7871.47 running on Microsoft Windows, Apple macOS, and Linux are vulnerable. All platforms using affected Chrome versions are in scope. Chrome Chromebooks are also affected. The vulnerability does not directly impact the underlying operating systems (Windows, macOS, Linux kernel) but uses Chrome as the attack surface.

Exploitability

Exploitability is moderate. The attack requires social engineering to convince a user to install a malicious extension, which raises the bar compared to in-the-wild web-based exploits. However, once an attacker controls extension installation (via phishing, compromise of extension store listings, or supply chain tactics), code execution is reliable. The vulnerability is not currently tracked in the CISA Known Exploited Vulnerabilities catalog, suggesting limited public weaponization as of the advisory date. Defenders should assume capability development by motivated threat actors.

Remediation

Organizations should immediately enforce Chrome version 150.0.7871.47 or later across all endpoints. Enable automatic Chrome updates to simplify compliance. Supplement patch deployment with user security awareness training emphasizing the risks of installing extensions from untrusted sources. Consider using endpoint management tools to restrict extension installation to organizational allow-lists and disable user-initiated extension installs in high-security environments. Monitor extension stores (Chrome Web Store, third-party marketplaces) for suspicious listings.

Patch guidance

Update Google Chrome to version 150.0.7871.47 or later. Verify the update through Chrome's Settings > About Google Chrome menu, which auto-checks for updates. Organizations using Google Admin Console can force Chrome updates via policy. Mac users should verify installation via System Information or the About Chrome menu. Linux users should update via their distribution's package manager or download directly from Google's release channels. Verify patch deployment within 7 days given the HIGH severity rating.

Detection guidance

Monitor for suspicious Chrome extension installations, particularly extensions requesting excessive permissions (file access, network interception, data processing). Inspect installed extensions via chrome://extensions/ and cross-reference against organizational allow-lists. Log extension installation events through endpoint detection and response (EDR) tools or Chrome enterprise logs. Monitor for anomalous child process spawning from Chrome processes, which may indicate successful code execution post-exploitation. Analyze outbound network connections from Chrome to detect data exfiltration or C2 communication from malicious extensions.

Why prioritize this

This vulnerability merits immediate remediation due to its HIGH CVSS score (8.1), full impact across confidentiality, integrity, and availability, and Chrome's ubiquity in enterprise and consumer environments. Although social engineering is required for initial infection, the post-installation code execution is reliable and requires no further user interaction. The lack of KEV listing does not diminish urgency—patch before external weaponization occurs. Organizations should treat this as P1 for endpoints, P2 for segmented/restricted environments.

Risk score, explained

The CVSS 3.1 score of 8.1 (HIGH) reflects: high attack complexity due to social engineering requirement; network-based attack vector; no privilege escalation needed post-infection; and high impact to confidentiality, integrity, and availability once the malicious extension executes. The score appropriately balances the user-interaction barrier against the severity of code execution. It does not account for organizational factors (e.g., extension policy enforcement) that defenders can implement to reduce practical risk.

Frequently asked questions