Description
Code injection in Extensions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted Chrome extension. (Chromium security severity: Medium)
Published: 2026-10-06
Score: 5.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Injection via crafted Chrome extensions
Action: Immediate Patch
AI Analysis

Impact

Code injection vulnerabilities in Chrome extensions allow an attacker to execute arbitrary code within the extension process. The flaw permits a malicious extension to spoof UI elements, potentially tricking users into interacting with fake dialogs or buttons. This increases the risk of phishing, credential theft, or further compromise of the host system. The identified weakness is CWE-94, a code injection flaw.

Affected Systems

Google Chrome prior to version 155.0.8059.39. The vulnerability affects all desktop builds of Chrome that have not yet applied the 155.0.8059.39 update.

Risk and Exploitability

The flaw is exploitable through social engineering: a user must be persuaded to install a malicious Chrome extension. No EPSS data is available, and the issue is not listed in the CISA KEV catalog, suggesting that it has not yet been widely targeted. The severity is medium, but the potential for an attacker to execute code and spoof the user interface makes the risk significant for users who install extensions from untrusted sources.

Generated by OpenCVE AI on October 7, 2026 at 13:11 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update Chrome to version 155.0.8059.39 or later
  • Remove any installed malicious or suspicious extensions from Chrome
  • Restrict extension installation to trusted sources and review permissions

Generated by OpenCVE AI on October 7, 2026 at 13:11 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4833-1 chromium security update
Debian DSA Debian DSA DSA-6553-1 chromium security update
History

Fri, 09 Oct 2026 00:15:00 +0000

Type Values Removed Values Added
Title chromium-browser: Code injection in Extensions
References
Metrics threat_severity

None

 threat_severity

Moderate

Wed, 07 Oct 2026 13:30:00 +0000

Type Values Removed Values Added
Title Code Injection via Crafted Chrome Extension Spoofing UI Elements
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*

Wed, 07 Oct 2026 11:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 07 Oct 2026 04:30:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Wed, 07 Oct 2026 02:15:00 +0000

Type Values Removed Values Added
Title Code Injection via Crafted Chrome Extension Spoofing UI Elements

Tue, 06 Oct 2026 19:00:00 +0000

Type Values Removed Values Added
Description Code injection in Extensions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted Chrome extension. (Chromium security severity: Medium)
Weaknesses CWE-94
References

Subscriptions

Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-10-07T10:30:15.066Z

Reserved: 2026-10-06T16:38:32.681Z

Link: CVE-2026-106416

cve-icon Vulnrichment

Updated: 2026-10-07T10:22:14.872Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-06T19:18:11.317

Modified: 2026-10-07T13:10:49.933

Link: CVE-2026-106416

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-10-06T18:41:23Z

Links: CVE-2026-106416 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-07T13:15:17Z

Weaknesses
  • CWE-94

    Improper Control of Generation of Code ('Code Injection')