CVE-2026-8587
HighSummary
A use after free vulnerability in Extensions in Google Chrome on Mac prior to version 148.0.7778.168 allows an attacker to execute arbitrary code via a malicious extension if a user installs it.
Risk Assessment
An attacker could exploit this vulnerability to gain control over the user's system, posing a significant threat to data security.
Recommendation
It is recommended to update Google Chrome to the latest version to mitigate this vulnerability and to avoid installing unknown extensions.
Other vulnerabilities in Google Chrome Extensions
See all- CVE-2016-1648High
A use-after-free vulnerability in the GetLoadTimes function in the Extensions implementation in Google Chrome before version 49.0.2623.108 allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JavaScript code.
- CVE-2026-12467High
Use after free in Extensions in Google Chrome prior to version 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
- CVE-2026-12457Medium
Inappropriate implementation in Extensions in Google Chrome prior to version 149.0.7827.155 allowed a remote attacker who compromised the renderer process to bypass site isolation via a crafted HTML page.
- CVE-2026-12456Medium
Inappropriate implementation in Extensions in Google Chrome prior to version 149.0.7827.155 allowed an attacker who convinced a user to install a malicious extension to bypass same origin policy via a crafted Chrome Extension.
- CVE-2026-12445High
A use after free vulnerability in Extensions in Google Chrome prior to version 149.0.7827.155 allowed an attacker to exploit heap corruption via a malicious extension if a user installed it.
- CVE-2026-12017Low
Inappropriate implementation in Extensions in Google Chrome prior to version 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page.
- CVE-2023-4366High
Use after free in Extensions in Google Chrome prior to version 116.0.5845.96 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page.
- CVE-2023-4078High
Inappropriate implementation in Extensions in Google Chrome prior to version 115.0.5790.170 allowed an attacker who convinced a user to install a malicious extension to inject scripts or HTML into a privileged page via a crafted Chrome Extension.
- CVE-2023-4077High
Insufficient data validation in Extensions in Google Chrome prior to version 115.0.5790.170 allowed an attacker who convinced a user to install a malicious extension to inject scripts or HTML into a privileged page via a crafted Chrome Extension.
Original NVD description (English source)
Use after free in Extensions in Google Chrome on Mac prior to 148.0.7778.168 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code via a crafted Chrome Extension. (Chromium security severity: Medium)