CVE-2026-15108: Chrome Extensions API Integer Overflow Information Disclosure

Technical summary

CVE-2026-15108 is an integer overflow (CWE-190) in Chrome's Extensions API affecting versions prior to 150.0.7871.115. The vulnerability allows out-of-bounds memory reads when a malicious extension sends a specially crafted payload to the Extensions API. Integer overflows in memory size calculations can cause the runtime to allocate smaller buffers than intended or validate bounds incorrectly, enabling out-of-bounds access. While the vulnerability is triggered via extension code, it resides in Chrome's core API handling, making it a platform-level weakness. The CVSS 3.1 score of 4.3 (MEDIUM, AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) reflects network availability, low attack complexity, required user interaction, and confidentiality impact without integrity or availability compromise.

Business impact

The primary risk is data leakage. A compromised user whose browser runs a malicious extension could have sensitive information read from Chrome's memory—potentially including credentials, session tokens, cached data, or information from other extensions. The attack surface is limited by the requirement that users actively install the malicious extension, which reduces the probability of widespread exploitation. However, targeted attacks against specific users (spear-phishing campaigns, supply chain compromises of extension distribution platforms, or social engineering) could expose valuable data. Organizations should assess whether their users are at elevated risk based on extension usage patterns and threat model.

Affected systems

Google Chrome versions prior to 150.0.7871.115 are vulnerable. The vulnerability is specific to Chrome and does not affect other Chromium-based browsers unless they also ship unpatched versions of the affected code. Users on stable, beta, or extended releases all face risk if they have not updated. Organizations with controlled Chrome deployments should verify their current version against the patch version to determine exposure.

Exploitability

Exploitation is feasible but requires user collaboration. An attacker must convince a user to install a malicious extension—either through social engineering, deceptive naming, compromised extension stores, or distribution via phishing. Once installed, the extension automatically gains API access and can trigger the integer overflow. The attack does not require zero-click delivery or browser exploitation; it leverages the extension platform's inherent trust model. Users unfamiliar with extension risks or those who install extensions from untrusted sources are at higher risk. The vulnerability is not known to be actively exploited in the wild, and it does not appear on CISA's Known Exploited Vulnerabilities catalog.

Remediation

Update Google Chrome to version 150.0.7871.115 or later. Google has patched the integer overflow in the Extensions API. Users should enable automatic updates to receive the patch automatically. Organizations should verify patch deployment across their fleet and consider disabling or vetting extensions from untrusted sources as a supplementary control. End users should review their installed extensions and remove any unfamiliar or unused ones.

Patch guidance

Google Chrome 150.0.7871.115 and later contain the fix. Verify your current version by navigating to Chrome > Settings > About Chrome, which will show your version number and trigger an automatic update check if needed. Organizations managing Chrome deployments via Group Policy or MDM should push the update through their standard patch management workflow. No special configuration is required post-patch; the Extensions API integer overflow handling is corrected transparently.

Detection guidance

Detection of active exploitation is limited without extension-level monitoring. Organizations can employ indirect signals: monitor for unexpected or unfamiliar extensions installed on managed Chrome instances using Chrome Enterprise or third-party MDM/endpoint detection platforms. Behavioral detection is difficult because the vulnerability results in memory reads, not file system or network activity. Preventive measures are more practical: enforce extension policies (block installation from unknown sources, maintain an approved list), and monitor Chrome audit logs for extension installation events. Consider periodic reviews of installed extensions across user devices.

Why prioritize this

This vulnerability merits timely but not emergency patching. The MEDIUM CVSS score and requirement for user-assisted extension installation significantly limit exposure compared to remote code execution flaws. However, the information disclosure capability and potential for targeted attacks against high-value users justify prioritization within a normal patch cycle. Organizations with users who frequently install browser extensions should prioritize deployment. Those in regulated industries handling sensitive data should factor confidentiality requirements into their patching timeline. The vulnerability is not listed on CISA's KEV catalog, further indicating it is not a current widespread threat.

Risk score, explained

CVSS 3.1 score of 4.3 (MEDIUM) reflects the balance between relatively low attack complexity and the requirement for user interaction. The network vector (AV:N) and low complexity (AC:L) account for the ease of crafting and delivering a malicious extension once social engineering succeeds. The requirement for user interaction (UI:R) and lack of availability/integrity impact significantly reduce the score. Confidentiality impact (C:L) acknowledges the information disclosure capability. The score appropriately positions this as a data-leakage risk rather than a critical system compromise vector.

Frequently asked questions