Google Chrome versions prior to 143.0.7499.192 lacked sufficient policy enforcement on the WebView tag, allowing an attacker who persuaded a user to install a malicious extension to inject arbitrary scripts or HTML into a privileged page. This flaw can enable the execution of code with elevated privileges in the context of the web page, potentially compromising user data and the security of the host system. The vulnerability is classified as high severity with a CVSS score of 8.8.

The affected product is Google Chrome for desktop. All releases prior to 143.0.7499.192 are vulnerable, until the policy enforcement fix is applied in the stated version. Users on earlier or equal versions should review their installed extensions for potential risks.

The exploitation probability (EPSS) is reported as less than 1%, indicating a very low likelihood of widespread attacks at the present time. However, the absence of a known exploit in the CISA KEV catalog does not negate the risk. Attackers must convince users to install a malicious Chrome extension, after which they can leverage the vulnerability to inject code into privileged pages. The high impact combined with low EPSS suggests that organizations should still prioritize mitigation, especially if they allow extension installations or handle sensitive data.