CVE-2026-17739

Analyzed Analyzed - Analysis Complete

Insufficient Policy Enforcement in Extensions in Google Chrome

Publication date: 2026-07-30

Last updated on: 2026-08-03

Assigner: Chrome

Description

Insufficient policy enforcement in Extensions in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension to inject arbitrary scripts or HTML (UXSS) via a crafted Chrome Extension. (Chromium security severity: Medium)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-30

Last Modified

2026-08-03

Generated

2026-08-19

AI Q&A

2026-07-30

EPSS Evaluated

2026-08-18

NVD

CVE-2026-17739

EUVD

EUVD-2026-50689

Affected Vendors & Products

Vendor	Product	Version / Range
google	chrome	to 151.0.7922.72 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability is an insufficient policy enforcement issue in Google Chrome's Extensions feature. It allows an attacker who tricks a user into installing a malicious extension to inject arbitrary scripts or HTML into web pages, potentially leading to a Universal Cross-Site Scripting (UXSS) attack.

Detection Guidance

This vulnerability involves insufficient policy enforcement in Chrome Extensions allowing script injection. To detect it, check installed extensions for unknown or suspicious ones via chrome://extensions. Look for extensions with excessive permissions or recent unknown installations. No specific commands are provided in the context.

Impact Analysis

This vulnerability could allow attackers to steal sensitive data like login credentials or personal information, modify website content, or perform actions on your behalf without your knowledge. It primarily affects users who install untrusted browser extensions.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling unauthorized script or HTML injection through malicious extensions. Such injections may lead to data exfiltration or manipulation, violating confidentiality and integrity requirements under these regulations.

Mitigation Strategies

Update Google Chrome to version 151.0.7922.72 or later to address the insufficient policy enforcement in Extensions that could allow UXSS attacks.

Hi! I’m here to help you understand CVE-2026-17739. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70