CVE-2026-14047: Chrome Extension CSP Bypass Vulnerability (CVSS 4.3)

Technical summary

CVE-2026-14047 stems from insufficient policy enforcement within Chrome's extension sandbox mechanism. The vulnerability allows a crafted extension to circumvent content security policy protections through CWE-602 (Client-Side Enforcement of Server-Side Security). The extension gains the ability to perform unauthorized content injection or manipulation that would normally be prevented by CSP headers and directives. The attack vector is network-based with low attack complexity, but requires user interaction (convincing installation) and does not cross security boundaries (single-user impact).

Business impact

While the CVSS score of 4.3 reflects a medium severity, the practical business risk is contextual. Organizations that allow employee installation of arbitrary Chrome extensions face integrity risks—malicious extensions could alter web content, inject advertising, harvest form data, or facilitate social engineering. The attack does not enable data exfiltration or availability disruption directly, but it does compromise the integrity of the browser environment and could be a stepping stone for further compromise.

Affected systems

Google Chrome browser versions prior to 150.0.7871.47 are affected. The vulnerability applies to all platforms running these Chrome versions (Windows, macOS, Linux). It does not affect Chromium itself unless compiled and distributed as a standalone browser, nor does it impact other Chromium-based browsers unless they have the same extension enforcement gap. Organizations should inventory deployed Chrome versions and extension policies.

Exploitability

Exploitability is limited by a hard prerequisite: the user must install the malicious extension. This is not a zero-click or drive-by vulnerability. The attacker must socially engineer the target into installing the extension, perhaps by disguising it, offering it as a tool or convenience feature, or distributing it through a compromised or lookalike store entry. Once installed, no further user action is required to trigger the CSP bypass. The low Chromium severity designation and absence from CISA's KEV catalog indicate this has not been weaponized in known active attacks at publication.

Remediation

Update Google Chrome to version 150.0.7871.47 or later. Users can check their version at chrome://version/ and enable automatic updates in Settings > About Google Chrome. Organizations should enforce Chrome update policies and consider using enterprise management tools (Chrome Enterprise or similar) to push the update and audit extension policies. Additionally, restrict the scope of extensions users can install and monitor for suspicious extension activity.

Patch guidance

Deploy Chrome 150.0.7871.47 or newer via your standard browser update mechanism. For enterprise environments, use Chrome Enterprise policies to force update requirements and disable sideloading of extensions if not needed. Verify the update by checking chrome://version/ on client machines. Google typically releases updates through the auto-update channel within a few hours to days of a security release.

Detection guidance

Monitor for suspicious extension installations in your environment using Chrome extension reporting tools or enterprise management console logs. Look for extensions from unknown publishers or with unusual requested permissions (especially 'all_urls' or content modification permissions). Monitor browser security event logs for CSP bypass attempts, though in-browser logging of CSP violations is limited unless enterprise policies enable extended logging. Network inspection for unusual post-install behavior may reveal injected or modified content being served to endpoints.

Why prioritize this

Although rated CVSS 4.3 (MEDIUM), prioritize patching based on your extension governance model. If your organization allows users to freely install extensions, update urgently because malicious extensions are a real threat vector. If you restrict extensions to an approved list and monitor them closely, the risk is lower but patching is still standard practice. The lack of KEV status and active exploitation suggests this is not an emergency, but should be included in your normal security update cycle within 30 days.

Risk score, explained

The CVSS 4.3 score reflects: network accessibility (AV:N), low attack complexity (AC:L), no privileges required (PR:N), but requires user interaction (UI:R), single-user scope (S:U), no confidentiality impact (C:N), low integrity impact (I:L), and no availability impact (A:N). The score is held down by the requirement for social engineering and the absence of confidentiality or availability loss. The vulnerability is not trivial—integrity breaches can be serious—but it is not critical in isolation.

Frequently asked questions