CVE-2026-17739: Google Chrome Extensions UXSS Vulnerability

CVE-2026-17739 Overview

CVE-2026-17739 is an insufficient policy enforcement vulnerability in the Extensions component of Google Chrome prior to version 151.0.7922.72. An attacker who convinces a user to install a malicious extension can inject arbitrary scripts or HTML into web pages through a crafted Chrome Extension. This class of flaw is known as Universal Cross-Site Scripting (UXSS) and breaks the same-origin boundary that normally isolates web contexts.

Google assigned the issue a Chromium security severity of Medium. The fix ships in the Stable channel update announced on the Chrome Releases blog.

Critical Impact
A malicious extension can bypass Extensions policy enforcement to execute attacker-controlled scripts or HTML in the context of arbitrary origins, enabling session theft, credential capture, and content manipulation across sites the user visits.

Affected Products

Google Chrome Desktop versions prior to 151.0.7922.72
Chromium-based browsers that incorporate the vulnerable Extensions code prior to the merged fix
Enterprise Chrome deployments running any pre-151 Stable channel build

Discovery Timeline

2026-07-30 - CVE-2026-17739 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17739

Vulnerability Analysis

The vulnerability resides in the Extensions subsystem of Google Chrome. Chrome enforces policies that constrain what an extension can inject into a page, which origins it can touch, and how content scripts interact with the DOM. Insufficient policy enforcement in this subsystem allows a crafted extension to bypass those constraints.

The result is Universal Cross-Site Scripting. Unlike standard XSS, which requires an injection point in a specific site, UXSS lets attacker-controlled JavaScript or HTML run in the context of any origin the extension can reach. Attackers use this to read authenticated content, exfiltrate cookies or tokens, and pivot to sensitive web applications the user has open.

Exploitation requires a social engineering step. The attacker must convince the user to install the malicious extension from a distribution channel such as the Chrome Web Store or a sideloaded package. Once installed, the extension operates with the elevated privileges Chrome grants to extensions and abuses the weak policy check to inject payloads.

Root Cause

The root cause is inadequate enforcement of extension policy boundaries in the Chrome Extensions component. The check that should restrict extension-driven content injection does not fully validate the target context, allowing scripts or HTML to reach origins that should be out of scope.

Attack Vector

The attack requires user interaction to install a malicious Chrome extension. After installation, the extension issues crafted API calls or DOM operations that exploit the missing policy check. The injected payload executes in the origin of the currently loaded page, giving the attacker full script access to that document.

See the Chromium Issue Tracker Entry and the Google Chrome Update Announcement for the vendor's technical references.

Detection Methods for CVE-2026-17739

Indicators of Compromise

Chrome browser version strings below 151.0.7922.72 reported by endpoint inventory or the chrome://version page
Recently installed extensions from unknown publishers or sideloaded from developer mode
Extension manifests requesting broad host permissions such as <all_urls> paired with scripting or webNavigation APIs
Unexpected outbound connections from the Chrome process to attacker-controlled domains shortly after extension install events

Detection Strategies

Inventory installed Chrome extensions across the fleet and compare identifiers against approved allowlists managed through Chrome Enterprise policy
Alert on Chrome process command lines that include --load-extension or --disable-extensions-except, which indicate sideloading
Correlate browser version telemetry with the fixed build 151.0.7922.72 and flag hosts running earlier releases
Hunt for anomalous script execution or DOM mutation patterns originating from extension contexts in browser telemetry

Monitoring Recommendations

Ingest Chrome browser and extension telemetry into a centralized data lake for longitudinal analysis of extension install and update events
Track newly published extensions across managed devices and require review before enterprise-wide rollout
Monitor for credential reuse or session anomalies on high-value web applications that could indicate UXSS-driven token theft

How to Mitigate CVE-2026-17739

Immediate Actions Required

Update all Chrome installations to version 151.0.7922.72 or later on Windows, macOS, and Linux
Audit installed extensions and remove any that are unapproved, unmaintained, or request permissions beyond their stated function
Enforce Chrome Enterprise ExtensionInstallAllowlist and ExtensionInstallBlocklist policies to restrict which extensions users can install
Disable developer mode extension sideloading on managed endpoints where it is not required

Patch Information

Google addressed CVE-2026-17739 in Chrome Stable 151.0.7922.72. Deploy the update through managed update channels or force a restart via Chrome Enterprise policy. Refer to the Google Chrome Update Announcement for the full advisory and to the Chromium Issue Tracker Entry for the underlying bug reference.

Workarounds

Restrict extension installation to an explicit allowlist through Chrome Enterprise policy until patching is complete
Set BlockExternalExtensions and force-install only vetted extensions via ExtensionInstallForcelist
Educate users to avoid installing extensions from prompts on untrusted websites or unsolicited messages

bash

# Example Chrome Enterprise policy fragment restricting extensions (Linux JSON policy)
{
  "ExtensionInstallBlocklist": ["*"],
  "ExtensionInstallAllowlist": [
    "aapocclcgogkmnckokdopfmhonfmgoek",
    "ghbmnnjooekpmoecnnnilnnbdlolhkhi"
  ],
  "BlockExternalExtensions": true,
  "DeveloperToolsAvailability": 2
}