CVE-2026-14003
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk4th percentile — higher than 4% of all known CVEs
Summary
Insufficient policy enforcement in Extensions in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinced a user to install a malicious extension to leak cross-origin data via a crafted Chrome Extension.
Risk Assessment
The risk involves potential theft of sensitive cross-origin data, which could lead to privacy breaches and leakage of business information.
Recommendation
Immediately update Google Chrome to version 150.0.7871.47 or later and educate users to install only trusted extensions.
Original NVD description (English source)
Insufficient policy enforcement in Extensions in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinced a user to install a malicious extension to leak cross-origin data via a crafted Chrome Extension. (Chromium security severity: Medium)