The vulnerability originates from missing authorization checks in a Chrome API. This flaw allows a remote attacker who succeeds in a social engineering attack to craft a malicious Chrome extension that can access sensitive browser data. The weakness is categorized as Authorization Failure (CWE-862), providing attackers an unauthorized entry to the system and enabling information disclosure.

Google Chrome components prior to version 155.0.8059.39 are affected, as the issue was fixed in that release. Any user operating an earlier stable channel version is at risk if they install extensions that may be malicious (inferred).

The vulnerability carries a CVSS score of 6.5, which is considered medium severity, and a very low EPSS score of less than 1%. It is not listed in the CISA KEV catalog. The likely attack vector involves the user installing a malicious extension that abuses the unauthenticated API. Once the extension is installed, the attacker can extract sensitive information without further privileges. The risk is heightened by the social engineering requirement, so environments with weak user awareness or lax extension controls are more susceptible (inferred).