Improper input validation in Chrome extensions before version 155.0.8059.39 allows a remote attacker who has persuaded a user to install a crafted extension to bypass the web origin policy and gain access to a privileged page. The vulnerability is an input validation flaw that does not normally provide broad exploitation capabilities but enables the attacker to reach privileged resources within the browser. Chromium rates the issue as low severity, indicating it is not a full remote code execution flaw but still poses a risk to the confidentiality of privileged data.

Google Chrome versions earlier than 155.0.8059.39 are affected. Users of desktop Chrome running these releases without the patch are vulnerable. Updated releases include the fix for the input validation issue.

The EPSS is < 1%, and the vulnerability is not listed in the CISA KEV catalog, which suggests limited or no observed exploitation at this time. Based on the description, the likely attack vector involves social engineering to install a malicious extension; only users who install the compromised extension are at risk. The risk is therefore considered moderate: the flaw does not provide arbitrary code execution, but it does allow access to privileged pages normally restricted by the web origin policy. No public exploit has been reported, and the CVSS score is 6.5, indicating moderate severity rather than a low severity, which still highlights a potential risk to the confidentiality of privileged data.