CVE-2026-8004: Google Chrome DevTools Data Leak Vulnerability

CVE-2026-8004 Overview

CVE-2026-8004 is an insufficient policy enforcement vulnerability in the DevTools component of Google Chrome prior to version 148.0.7778.96. The flaw allows an attacker who convinces a user to install a malicious extension to leak cross-origin data through a crafted Chrome Extension. Google's Chromium project rated the security severity as Low. The issue falls under [CWE-693] Protection Mechanism Failure, where DevTools fails to enforce same-origin policies expected of extension contexts.

Critical Impact
A malicious Chrome extension can bypass DevTools policy controls to read cross-origin data, exposing information from sites the user is authenticated to.

Affected Products

Google Chrome versions prior to 148.0.7778.96
Chromium-based browsers using affected DevTools code paths
Desktop Stable channel installations on Windows, macOS, and Linux

Discovery Timeline

2026-05-06 - CVE-2026-8004 published to NVD
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-8004

Vulnerability Analysis

The vulnerability resides in Chrome's DevTools subsystem, which exposes powerful inspection and debugging interfaces to extensions that request the devtools permission. DevTools must enforce strict origin boundaries because it can access page content, network traffic, and runtime state across tabs. In affected versions, policy checks within DevTools are insufficient, allowing extension code paths to interact with resources beyond their intended origin scope.

An attacker exploits this by publishing or distributing a crafted Chrome Extension. Once a victim installs the extension, the extension uses DevTools APIs to read content, headers, or scripts associated with origins the user is authenticated to. The result is information disclosure of cross-origin data such as session tokens embedded in pages, authenticated API responses, or DOM content from third-party sites.

Successful exploitation requires user interaction in the form of installing the malicious extension. Confidentiality is the primary impact; integrity and availability are unaffected.

Root Cause

The root cause is a Protection Mechanism Failure [CWE-693] in DevTools origin enforcement. Policy checks that should restrict extension-driven DevTools operations to permitted origins are missing or incomplete, permitting cross-origin reads that the same-origin policy would otherwise block.

Attack Vector

The attack vector is network-based but mediated through a locally installed extension. The attacker distributes a malicious extension via the Chrome Web Store, sideloading, or social engineering. After installation, the extension silently issues DevTools calls against pages the user visits and exfiltrates the leaked cross-origin data to an attacker-controlled endpoint.

No proof-of-concept exploit code is publicly available. The vulnerability mechanism is described in the Chromium Issue Tracker Entry and the Google Chrome Update Notice.

Detection Methods for CVE-2026-8004

Indicators of Compromise

Newly installed Chrome extensions requesting the devtools_page manifest field combined with broad host permissions
Outbound HTTPS connections from the browser process to unfamiliar domains correlated with extension activity
Extension IDs not present in your organization's allowlist appearing in chrome.management inventories

Detection Strategies

Inventory installed Chrome extensions across managed endpoints and compare against an approved baseline
Inspect extension manifests for the devtools_page declaration and unusually broad host_permissions
Correlate browser process network telemetry with extension install events to identify exfiltration patterns

Monitoring Recommendations

Enable Chrome Enterprise reporting to forward extension install, update, and removal events to your SIEM
Alert on installations of extensions outside the corporate Chrome Web Store allowlist
Monitor Chrome version telemetry to confirm endpoints are running 148.0.7778.96 or later

How to Mitigate CVE-2026-8004

Immediate Actions Required

Update Google Chrome to version 148.0.7778.96 or later on all managed endpoints
Audit installed extensions and remove any that are unsigned, unverified, or unnecessary
Enforce an extension allowlist through Chrome Enterprise policy to prevent unauthorized installs

Patch Information

Google released the fix in the Chrome Stable channel update documented in the Google Chrome Update Notice. Upgrade to Chrome 148.0.7778.96 or newer to remediate the issue. Chromium-derived browsers should be updated once their vendors integrate the upstream fix.

Workarounds

Set the ExtensionInstallBlocklist Chrome policy to * and use ExtensionInstallAllowlist to permit only vetted extensions
Disable developer mode and sideloading on managed devices to block unsigned extension installation
Educate users to avoid installing extensions from outside the Chrome Web Store and from untrusted publishers

bash

# Configuration example: Chrome Enterprise policy to restrict extensions (Linux managed JSON)
cat > /etc/opt/chrome/policies/managed/extension_policy.json <<'EOF'
{
  "ExtensionInstallBlocklist": ["*"],
  "ExtensionInstallAllowlist": [
    "<approved-extension-id-1>",
    "<approved-extension-id-2>"
  ],
  "DeveloperToolsAvailability": 2
}
EOF