CVE-2026-14047
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk7th percentile — higher than 7% of all known CVEs
Summary
Insufficient policy enforcement in Extensions in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinced a user to install a malicious extension to bypass Content Security Policy via a crafted Chrome Extension.
Risk Assessment
The risk involves a malicious extension bypassing CSP, potentially leading to unauthorized script execution in the browser context and possible data leakage.
Recommendation
It is recommended to immediately update Google Chrome to version 150.0.7871.47 or later and educate users to install only trusted extensions.
Original NVD description (English source)
Insufficient policy enforcement in Extensions in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinced a user to install a malicious extension to bypass content security policy via a crafted Chrome Extension. (Chromium security severity: Low)