The extension subsystem in Google Chrome before 17.0.963.78 does not properly handle history navigation which allows remote attackers to execute arbitrary code by leveraging a \Universal XSS (UXSS)\ issue.