A missing authorization check in Chrome’s DevTools allows a remote attacker to craft a malicious Chrome extension that bypasses the browser’s web origin policy. The attacker can read or modify data from sites the browser normally isolates, but the flaw does not provide direct code execution. The issue originates from improper authorization, identified as CWE-862.

Google Chrome products are affected, specifically versions prior to 155.0.8059.39. Any user running these older releases is vulnerable until an update is applied.

The CVSS score of 6.5 indicates a moderate severity vulnerability. The EPSS score of < 1% indicates a very low likelihood of exploitation, and the vulnerability is not listed in CISA KEV. The exploit requires a user to install a malicious extension, which suggests social engineering or phishing is a prerequisite. Once the extension is installed, the attacker effectively bypasses the web origin policy, granting privileged access to cross‑origin data or content manipulation. No immediate public exploitation is reported, but the flaw remains present until patched.