The flaw is an incorrect authorization check performed by Google Chrome when a USB device is accessed by a browser extension. An attacker can create a specially crafted extension that misleads a user into installing it, enabling the extension to act with higher privileges than a normal extension. This allows the attacker to bypass system access restrictions, potentially enabling the reading or writing of files and other actions that normally require higher authority. The issue is classified under the weakness CWE‑863, Unauthorized Access to Resource Privilege.

The vulnerability exists in Google Chrome versions prior to 155.0.8059.39. Users running these builds in the stable channel are affected, while newer builds have the fix.

The attacker requires a social‑engineering vector to convince a user to install the malicious extension, so exploitation depends on user interaction. The Chromium severity rating for this issue is Medium, corresponding to a CVSS score of 6.5, and the EPSS score is < 1%; the vulnerability is not listed in the CISA KEV catalog. The combination of a medium severity rating and the need for user action suggests a moderate exploitation likelihood.