CVE-2026-7941 in Chrome
Summary
by MITRE • 05/06/2026
Insufficient validation of untrusted input in Mobile in Google Chrome on Android prior to 148.0.7778.96 allowed a local attacker to inject arbitrary scripts or HTML (UXSS) via a crafted Chrome Extension. (Chromium security severity: Medium)
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 05/17/2026
This vulnerability represents a critical cross-site scripting flaw in the chromium-based google chrome browser for android platforms. The issue stems from inadequate input validation mechanisms within the chrome extension framework that processes untrusted data from malicious sources. A local attacker with access to the device can exploit this weakness by crafting a specially designed chrome extension that contains malicious script or html content. The vulnerability specifically affects versions prior to 148.0.7778.96 and operates through a universal cross-site scripting vector that bypasses standard security controls. The technical implementation involves the browser's failure to properly sanitize or validate extension metadata, manifest files, or runtime parameters that are processed without adequate security checks. This allows malicious code to execute in the context of the chrome browser, potentially compromising user data and system integrity.
The operational impact of this vulnerability extends beyond typical web-based attacks as it leverages the privileged position of chrome extensions to gain unauthorized access to user sessions and sensitive information. An attacker can manipulate extension behavior to inject persistent scripts that execute whenever the browser is active, creating a persistent threat vector that can harvest cookies, intercept communications, or perform unauthorized actions on behalf of the user. The medium severity classification according to chromium security standards reflects the specific nature of the attack surface and the requirement for local access, but the potential for data exfiltration and session hijacking makes this a significant concern for mobile users. The vulnerability aligns with CWE-79 which describes cross-site scripting flaws, and can be mapped to ATT&CK technique T1059.007 for script execution and T1555.004 for credentials access through browser artifacts.
Mitigation strategies should prioritize immediate patching of affected chrome versions to the latest stable release that includes security fixes for this vulnerability. Users should disable or remove any suspicious chrome extensions and ensure their browser remains updated with the most recent security patches. Organizations should implement browser hardening policies that restrict extension installation and monitor for unauthorized extension modifications. Network administrators can deploy web application firewalls and content filtering solutions to detect and block malicious extension payloads, while security teams should conduct regular vulnerability assessments focusing on mobile browser security configurations. Additionally, users should be educated about the risks of installing extensions from untrusted sources and the importance of maintaining updated browser software to prevent exploitation of known vulnerabilities.