An extension input validation flaw in Google Chrome allows a remote attacker who has gained control of the renderer process to supply crafted HTML that bypasses the browser's same‑origin policy. This flaw, identified as a CWE‑20 weakness, enables the attacker to read from or write to data belonging to other origins, potentially exposing or manipulating sensitive user information. The vulnerability is classified as high severity by Chrome's security team, indicating a significant potential impact on confidentiality and integrity.

The issue affects all installations of Google Chrome running versions earlier than 149.0.7827.53. Any user or system with this version of Chrome and the Chrome Extensions framework is exposed.

The exploit requires a compromised renderer process, which typically would be achieved via a malicious or manipulated extension or through a privileged web page that escalates to renderer control. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that large‑scale exploitation is not currently documented. However, the high severity rating and the requirement for renderer compromise imply that the attack could be carried out by an attacker with web‑browsing access combined with an extension or website that triggers renderer break. Monitoring for malicious extension behavior and ensuring the latest browser version are the primary protection measures.