CVE-2026-17899

Analyzed Analyzed - Analysis Complete

Insufficient Policy Enforcement in Google Chrome DevTools

Publication date: 2026-07-30

Last updated on: 2026-08-03

Assigner: Chrome

Description

Insufficient policy enforcement in DevTools in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension to perform privilege escalation via a crafted Chrome Extension. (Chromium security severity: Low)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-30

Last Modified

2026-08-03

Generated

2026-08-19

AI Q&A

2026-07-30

EPSS Evaluated

2026-08-18

NVD

CVE-2026-17899

EUVD

EUVD-2026-50648

Affected Vendors & Products

Vendor	Product	Version / Range
google	chrome	to 151.0.7922.72 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-693	The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

Attack-Flow Graph

Executive Summary

This vulnerability is an insufficient policy enforcement issue in Google Chrome's DevTools. It allows an attacker who tricks a user into installing a malicious extension to escalate privileges through a crafted Chrome Extension. The attack requires user interaction to install the extension.

Detection Guidance

This vulnerability involves insufficient policy enforcement in Chrome's DevTools, allowing privilege escalation via malicious extensions. Detection requires checking Chrome version and installed extensions. Use chrome://version to verify Chrome version and ensure it is 151.0.7922.72 or later. Inspect extensions via chrome://extensions for any suspicious or unauthorized ones.

Impact Analysis

If you are tricked into installing a malicious extension, an attacker could gain elevated privileges in your Chrome browser. This could allow them to perform unauthorized actions, access sensitive data, or install further malicious software on your system.

Compliance Impact

This vulnerability involves insufficient policy enforcement in Google Chrome's DevTools, allowing privilege escalation via a malicious extension. While it does not directly impact GDPR or HIPAA compliance, it could indirectly affect compliance by enabling unauthorized access to sensitive data if exploited. Organizations must ensure extensions are vetted to mitigate such risks.

Mitigation Strategies

Update Google Chrome to version 151.0.7922.72 or later to address the insufficient policy enforcement in DevTools.

Hi! I’m here to help you understand CVE-2026-17899. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70