CVE-2026-40451: DeepL Chrome Extension XSS Vulnerability

CVE-2026-40451 Overview

CVE-2026-40451 is a cross-site scripting (XSS) vulnerability affecting the DeepL Chrome browser extension versions v1.22.0 to v1.23.0. This vulnerability allows an attacker to execute arbitrary script in a user's browser and inject malicious HTML into web pages viewed by the user. As a browser extension vulnerability, successful exploitation could compromise user sessions, steal sensitive information, or manipulate web content across sites the victim visits.

Critical Impact

Attackers can execute arbitrary JavaScript in a victim's browser context, potentially leading to session hijacking, credential theft, or malicious content injection across visited web pages.

Affected Products

• DeepL Chrome browser extension v1.22.0
• DeepL Chrome browser extension versions between v1.22.0 and v1.23.0
• DeepL Chrome browser extension v1.23.0

Discovery Timeline

• 2026-04-22 - CVE-2026-40451 published to NVD
• 2026-04-22 - Last updated in NVD database

Technical Details for CVE-2026-40451

Vulnerability Analysis

This cross-site scripting vulnerability (CWE-79) exists within the DeepL Chrome browser extension. The flaw allows attackers to inject and execute malicious scripts within the context of the browser extension. Since browser extensions often have elevated privileges compared to standard web pages, XSS vulnerabilities in extensions can have significant security implications.

The vulnerability requires user interaction to exploit, meaning an attacker would need to craft a malicious scenario where the victim interacts with specially crafted content while the vulnerable extension is active. Upon successful exploitation, the attacker gains the ability to execute arbitrary JavaScript code and inject malicious HTML content into web pages the victim views.

Browser extension XSS vulnerabilities are particularly concerning because extensions may have access to sensitive browser APIs, cross-origin data, or stored credentials that standard web page scripts cannot access.

Root Cause

The vulnerability stems from improper input validation and inadequate sanitization of user-controlled data within the DeepL Chrome extension. When the extension processes certain inputs, it fails to properly escape or sanitize content before rendering it in the browser context, allowing injection of executable script content.

This is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), indicating that the extension does not properly neutralize script-related input before incorporating it into output rendered in the user's browser.

Attack Vector

The attack leverages the network vector, meaning an attacker can exploit this vulnerability remotely. However, user interaction is required for successful exploitation. A typical attack scenario involves:

1. An attacker crafts malicious content designed to trigger the XSS vulnerability
2. The victim, with the vulnerable DeepL extension installed, encounters this content
3. The malicious script executes in the context of the user's browser session
4. The attacker can then steal session tokens, modify page content, or perform actions on behalf of the user

For detailed technical information about this vulnerability, refer to the GitHub Security Advisory or the JVN Security Advisory JVN37524771.

Detection Methods for CVE-2026-40451

Indicators of Compromise

• Unusual JavaScript execution or DOM modifications on pages where the DeepL extension is active
• Unexpected network requests originating from the browser extension context
• Browser extension behaving abnormally or making requests to unknown domains
• User reports of unexpected content or pop-ups when using the DeepL extension

Detection Strategies

• Monitor browser extension versions deployed across the organization and flag installations of DeepL Chrome extension versions v1.22.0 through v1.23.0
• Implement Content Security Policy (CSP) monitoring to detect potential XSS exploitation attempts
• Review browser extension activity logs for anomalous script injection patterns
• Deploy endpoint detection solutions capable of monitoring browser extension behavior

Monitoring Recommendations

• Enable browser extension audit logging to track extension activities and identify suspicious behavior
• Implement centralized browser management to maintain visibility into installed extensions and their versions
• Configure web proxy logging to capture and analyze traffic patterns associated with browser extensions
• Establish alerting for users accessing sensitive resources while running vulnerable extension versions

How to Mitigate CVE-2026-40451

Immediate Actions Required

• Update the DeepL Chrome browser extension to the latest patched version immediately
• Conduct an inventory of all browser extensions deployed within the organization to identify vulnerable installations
• Consider temporarily disabling the DeepL Chrome extension until the update can be applied
• Educate users about the risks of browser extension vulnerabilities and the importance of keeping extensions updated

Patch Information

DeepL has released security updates to address this vulnerability. Users should update their DeepL Chrome browser extension to a version newer than v1.23.0 through the Chrome Web Store or their organization's extension management system. For additional details, refer to the GitHub Security Advisory.

Workarounds

• Temporarily disable or uninstall the DeepL Chrome extension until the patched version is deployed
• Use browser policies to restrict extension permissions where possible
• Implement network-level filtering to monitor and restrict extension-related traffic
• Consider using alternative translation services or the DeepL web interface until the extension is updated

# Chrome Enterprise Policy - Disable specific extension version (Windows Registry)
# Block vulnerable DeepL extension versions via group policy
reg add "HKLM\SOFTWARE\Policies\Google\Chrome\ExtensionInstallBlocklist" /v 1 /t REG_SZ /d "cofdbpoegempjloogbagkncekinflcnj;1.22.0-1.23.0" /f

# Alternative: Force extension update via Chrome policy
reg add "HKLM\SOFTWARE\Policies\Google\Chrome" /v ExtensionSettings /t REG_SZ /d "{\"cofdbpoegempjloogbagkncekinflcnj\":{\"minimum_version_required\":\"1.24.0\"}}" /f