CVE-2026-78960 in Chrome
Summary
by MITRE • 08/26/2026
Information leak in Extensions in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to obtain cross-origin data via a crafted Chrome extension. (Chromium security severity: Medium)
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/26/2026
The vulnerability identified as an information leak within the extensions subsystem of Google Chrome prior to version 152.0.7977.65 represents a significant breach in browser isolation mechanisms, specifically affecting how cross-origin data is handled by third-party or user-installed add-ons. This flaw stems from insufficient validation and access control checks when an extension attempts to interact with web content across different origins. In the context of modern web browsers, extensions operate within a sandboxed environment designed to prevent them from accessing sensitive data belonging to other sites unless explicitly permitted by the user through manifest permissions or runtime prompts. However, in this specific instance, the architectural implementation failed to strictly enforce these boundaries under certain conditions involving crafted extension code. This allows an attacker who has successfully installed a maliciously constructed Chrome extension to bypass standard same-origin policies and retrieve sensitive information such as cookies, local storage contents, session tokens, or other private data from websites visited by the user that reside on different domains than the extension itself.
The operational impact of this vulnerability is primarily driven by social engineering tactics rather than purely technical exploitation vectors like remote code execution via network packets. Because the attack requires the installation and activation of a malicious extension, it relies heavily on deceiving the end-user into granting necessary permissions or simply installing an untrusted add-on from unofficial sources or through deceptive prompts disguised as legitimate utilities. Once installed, the crafted extension can silently exfiltrate cross-origin data without triggering standard browser security warnings that might alert the user to suspicious activity. This capability effectively undermines the principle of least privilege and compromises the confidentiality of user sessions across multiple websites. For enterprise environments where managed extensions are deployed, this could lead to significant insider threats or external espionage if a compromised extension is pushed via policy but contains hidden malicious logic exploiting this flaw.
From a classification perspective, this vulnerability aligns with CWE-200, which defines an Information Exposure, specifically falling under categories related to exposure of sensitive information through improper access controls. It also maps closely to MITRE ATT&CK technique T1537, which involves Data Transfer from Cloud Storage or Exfiltration Over Alternative Protocol, although in this case the exfiltration is facilitated by a local application component rather than direct network protocol abuse. The attack vector corresponds to Initial Access via Trusted Software Supply Chain compromise if the extension was distributed through official channels but tampered with, or more commonly Social Engineering: User Execution when users install rogue extensions from third-party repositories.
Mitigation strategies for this vulnerability center on immediate software updates and rigorous access control policies. Users must upgrade Google Chrome to version 152.0.7977.65 or later where the underlying Chromium security patches address these permission checks and enforce stricter isolation between extension contexts and web page origins. For administrators, it is critical to audit installed extensions regularly and restrict installation sources to official channels only. Implementing Content Security Policy (CSP) headers on internal applications can provide an additional layer of defense by limiting how data is rendered and accessed, although this does not directly fix the browser-side flaw. Furthermore, educating users about the risks of installing unverified extensions remains a vital component of security hygiene, as technical controls alone cannot prevent social engineering attacks that lead to malicious software installation.