The vulnerability CVE-2026-17739 involves insufficient policy enforcement in the Extensions component of Google Chrome versions before 151.0.7922.72. An attacker can exploit this by persuading a user to install a crafted malicious extension, which then can inject arbitrary scripts or HTML into the browser context, leading to a UXSS vulnerability. This can potentially allow script injection attacks that bypass same-origin policies within the browser environment.

Successful exploitation allows an attacker to inject arbitrary scripts or HTML via a malicious Chrome extension, potentially leading to UXSS attacks. This could compromise the security context of web pages viewed by the user, possibly enabling unauthorized actions or data exposure within the browser session. However, exploitation requires user interaction to install the malicious extension.

A fix is available in Google Chrome version 151.0.7922.72 and later. Users and administrators should update to this version or later to remediate the vulnerability. Since this is a client-side application, patching the browser is the recommended mitigation. No additional vendor advisory content is provided, so check official Google Chrome release notes for confirmation and further guidance.