CVE-2026-5901: 
vulnerability analysis and mitigation

CVE-2026-5901 is a policy bypass vulnerability in Google Chrome's DevTools component that allows an attacker who convinces a user to install a malicious Chrome extension to bypass enterprise host restrictions for cookie modification. It affects Google Chrome versions prior to 147.0.7727.55 and Microsoft Edge (Chromium-based). The vulnerability was reported by Povcfe of Tencent Security Xuanwu Lab on January 29, 2026, and patched in Chrome 147.0.7727.55 released on April 7, 2026. It carries a CVSS v3.1 base score of 6.5 (Medium) and is rated Low severity by Chromium's internal severity scale (Chrome Release, GitHub Advisory).

The root cause is classified as CWE-602 (Client-Side Enforcement of Server-Side Security), where Chrome's DevTools component insufficiently enforces enterprise policies that are intended to restrict cookie modification on specific hosts. A crafted Chrome Extension can leverage DevTools APIs to circumvent these server-side security controls, which are enforced only at the client level. Exploitation requires user interaction — specifically, the victim must be convinced to install a malicious extension — making the attack vector network-based but socially engineered. The Chromium bug tracker entry is issue #479673903, though full technical details remain restricted (Chrome Release, GitHub Advisory).

Successful exploitation allows an attacker to bypass enterprise security policies that restrict cookie modification on designated hosts, potentially enabling session hijacking, credential theft, or unauthorized access to web applications within an enterprise environment. The primary impact is on integrity (CVSS integrity impact: High), as cookies can be modified without authorization; there is no direct confidentiality or availability impact. In enterprise contexts, this bypass could undermine access controls protecting sensitive internal web applications, with potential for lateral movement if session tokens are hijacked (GitHub Advisory, Feedly).

1. Craft a malicious Chrome extension: Develop a Chrome extension that uses DevTools APIs (e.g., the chrome.debugger or cookies API) to interact with restricted hosts and modify cookies in ways that enterprise policies are intended to prevent.
2. Social engineering: Convince a target user to install the malicious extension, for example by distributing it via a phishing email, a fake software download page, or a compromised internal tool repository.
3. Extension installation: The victim installs the extension, granting it the permissions declared in its manifest (e.g., cookies, debugger, or host permissions).
4. Policy bypass via DevTools: The extension leverages insufficient policy enforcement in Chrome's DevTools component to modify cookies on enterprise-restricted hosts, bypassing controls that should prevent such modifications.
5. Session hijacking or credential theft: The attacker uses the modified cookies to impersonate the victim on targeted web applications, gaining unauthorized access to enterprise resources (Chrome Release, GitHub Advisory).

• Browser/Extension: Presence of an unrecognized or unauthorized Chrome extension with permissions including cookies, debugger, or broad host permissions (<all_urls>) in enterprise-managed environments.
• Logs: Chrome enterprise policy logs showing cookie modification events on hosts that should be restricted; browser event logs indicating DevTools API usage by an extension on sensitive hosts.
• Network: Unexpected session tokens or cookie values observed in web application access logs for enterprise hosts, particularly following extension installation events.
• Process: Chrome processes spawning with DevTools protocol connections initiated by an extension rather than a developer tool.

Users and administrators should upgrade Google Chrome to version 147.0.7727.55 or later (147.0.7727.55/56 on Windows/Mac, 147.0.7727.55 on Linux); Microsoft Edge (Chromium-based) users should apply the corresponding Microsoft security update. As a workaround, enterprise administrators should enforce Chrome extension management policies to restrict installation to an approved allowlist and audit existing extensions for suspicious permissions. User education about the risks of installing extensions from untrusted sources is also recommended (Chrome Release, Microsoft MSRC).

The vulnerability was covered as part of broader reporting on the Chrome 147 security update, which included over 60 fixes including two critical WebML flaws. Security news outlets such as GBHackers noted the large number of fixes in this release. The Chromium security team rated this specific issue as Low severity, reflecting its social engineering prerequisite and limited direct impact compared to other vulnerabilities in the same release (Chrome Release).