VULNERABILITY DETAILS
By accessing specific URLs exposed by chrome extensions via the "web_accessible_resources" property, it is possible to corrupt the chrome extension from any untrusted Javascript context.

Any extension exposing a web accessible resource using a wildcard syntax is susceptible to the crash and corruption when performing a "GET" request (for example using the fetch API) to the root of the directory preceding the wildcard. See "Reproduction Case" for real-world example.

Some of the most popular extensions on the chrome store utilize wildcards for web accessible content and corrupting those extensions via a web page controlled by an attacker poses significant risk to the user (e.g. disabling of various security and content blocking extensions)


VERSION
Chrome Version: 
stable - 64.0.3282.167 (Official Build) (64-bit)
beta - 65 (64-bit) (Unknown specific version)

Operating Systems:
Linux 4.13.0-32-generic #35-Ubuntu (64bit)
Windows 10 (fully updated) (64bit)
MacOS 10.13 ("High Sierra") (64bit)

REPRODUCTION CASE
For example, let's take extension "lgblnfidahcdcjddiepkckcfdhpknnjh" (Fair AdBlocker).
By inspecting its manifest we can see the web accessible content is exposed using the wildcard: "views/web_accessible/*"

Inherently, by being exposed as web accessible, this resource is CORS accessible most contexts.
Triggering a GET request to the parent directory preceding the wildcard will kill and corrupt the extension, preventing it from loading henceforth.

Reproduceable from a chrome console by executing:
fetch("chrome-extension://lgblnfidahcdcjddiepkckcfdhpknnjh/views/web_accessible")

Verified against multiple popular extensions including: Honey, Avast Online Security, Sourcegraph, Fair AdBlocker.