CVE-2026-78960: Chrome Extensions Information Disclosure Flaw

CVE-2026-78960 Overview

CVE-2026-78960 is an information disclosure vulnerability in the Extensions component of Google Chrome prior to version 152.0.7977.65. A remote attacker can obtain cross-origin data by convincing a user to install a crafted Chrome extension. The Chromium project rated the security severity as Medium and classified the weakness under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor).

Exploitation requires social engineering because the attacker must persuade the target to install a malicious extension. Once installed, the extension can bypass same-origin protections and read data belonging to other web origins.

Critical Impact
A malicious Chrome extension can exfiltrate cross-origin data from browsing sessions, including data from authenticated web applications the user visits.

Affected Products

Google Chrome for Desktop versions prior to 152.0.7977.65
Chromium-based browsers that incorporate the same Extensions code path
Managed Chrome deployments that have not yet received the Stable channel update

Discovery Timeline

2026-08-25 - CVE-2026-78960 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-78960

Vulnerability Analysis

The vulnerability resides in the Extensions subsystem of Chrome, which mediates how extension code interacts with web content, browser APIs, and privileged contexts. A crafted extension can leverage this flaw to read data across origin boundaries that should be isolated by the browser's same-origin policy.

The issue falls under information exposure rather than memory corruption or arbitrary code execution. The consequence is confidentiality loss: session content, authenticated responses, or DOM data from origins unrelated to the extension's declared host permissions can be observed by the attacker's extension.

The EPSS model estimates a probability of 0.265% with a percentile of 18.069, indicating limited near-term exploitation activity at the time of publication. Public technical details are limited; the Chromium tracker at Chromium Issue #533917984 remains restricted pending broader patch deployment.

Root Cause

The root cause is improper enforcement of cross-origin data isolation within the Extensions component. An extension can reach data belonging to origins outside the boundaries the browser is expected to enforce, producing the leak described in the advisory.

Attack Vector

The attack requires two conditions. First, the attacker must publish or distribute a crafted extension. Second, the user must be socially engineered into installing it, for example through a fraudulent Chrome Web Store listing, a sideloaded package, or a supply chain compromise of an existing extension. Once loaded, the extension executes the technique that yields cross-origin data.

No verified proof-of-concept code is publicly available. Refer to the Chrome Stable Channel Update for the vendor advisory.

Detection Methods for CVE-2026-78960

Indicators of Compromise

Installation events for Chrome extensions from outside approved enterprise allowlists or from developer mode sideloading.
Extensions requesting broad host permissions such as <all_urls> or scripting access unrelated to their stated functionality.
Outbound HTTPS connections from chrome.exe to attacker-controlled domains correlated with recently installed extensions.

Detection Strategies

Inventory installed extensions across managed endpoints and compare against an approved list, flagging unknown extension IDs.
Monitor Chrome preferences files and the Extensions directory under the user profile for new or modified entries.
Alert on Chrome versions below 152.0.7977.65 reported by endpoint telemetry or software inventory tools.

Monitoring Recommendations

Ingest browser and process telemetry into a centralized data lake to correlate extension installation events with subsequent outbound traffic.
Track user reports of unexpected browser behavior, unfamiliar toolbar entries, or unauthorized data access in web applications.
Review Chrome enterprise reporting for ExtensionInstallEvent records and cross-reference with change-control records.

How to Mitigate CVE-2026-78960

Immediate Actions Required

Update Google Chrome to version 152.0.7977.65 or later on all managed endpoints.
Audit currently installed extensions and remove any that are unused, unknown, or lack a verified publisher.
Restrict extension installation through Chrome enterprise policies such as ExtensionInstallAllowlist and ExtensionInstallBlocklist.

Patch Information

Google released the fix in the Chrome Stable channel version 152.0.7977.65. Details are available in the Chrome Stable Channel Update. Enterprises using managed Chrome should verify that automatic updates have propagated and force restart Chrome processes to apply the patched binary.

Workarounds

Enforce ExtensionInstallBlocklist set to * and explicitly allowlist only vetted extension IDs until patching completes.
Disable developer mode extension loading for standard users through the DeveloperToolsAvailability policy.
Train users to reject unsolicited requests to install browser extensions, particularly those delivered by email or messaging platforms.

bash

# Example Chrome enterprise policy (Linux) restricting extension installation
# /etc/opt/chrome/policies/managed/extension_policy.json
{
  "ExtensionInstallBlocklist": ["*"],
  "ExtensionInstallAllowlist": [
    "<approved-extension-id-1>",
    "<approved-extension-id-2>"
  ],
  "DeveloperToolsAvailability": 2
}