CVE-2026-17821 describes a security weakness in Google Chrome's extension policy enforcement mechanism before version 151.0.7922.72. The vulnerability allows an attacker to bypass navigation restrictions by exploiting insufficient policy enforcement in Chrome Extensions. This requires user interaction, specifically convincing the user to install a malicious extension. The issue is classified under CWE-602 (Improper Restriction of XML External Entity Reference). The CVSS v3.1 base score is 6.5, indicating a medium severity level, with attack vector network, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact. There are no known exploits in the wild at this time. The vendor has published an advisory but has not explicitly stated the remediation level or patch availability in the provided data.

An attacker who successfully convinces a user to install a crafted malicious Chrome extension can bypass navigation restrictions that are normally enforced by Chrome policies. This can lead to unauthorized actions or integrity violations within the browser environment. There is no impact on confidentiality or availability. The vulnerability requires user interaction and network access but no privileges.

The vulnerability affects Chrome versions prior to 151.0.7922.72. Users and administrators should update to version 151.0.7922.72 or later to remediate this issue. The vendor advisory linked should be consulted for the latest update and patch status. Since this is not a cloud service, remediation depends on applying the update on client installations. No other mitigation or temporary workaround is indicated in the advisory.