Technical impact
Insufficient policy enforcement in Google Chrome extensions allows an attacker who convinces a user to install a malicious extension to bypass discretionary access control. This weakness corresponds to CWE-280 and CWE-732. The crafted extension can acquire privileges beyond those intended for an extension, and based on the description, it is inferred that the attacker could read, modify, or delete user data and execute restricted operations.
Affected Systems
Google Chrome versions prior to 149.0.7827.53 are affected. No additional vendor or product details are listed.
Risk and Exploitability
The vulnerability is exploitable once a user installs a malicious extension; the attacker must otherwise convince the user to do so. The EPSS score is less than 1%, and the vulnerability is not listed in KEV, indicating a low to moderate likelihood of exploitation. The CVSS score is 6.5 (Medium), and Chromium security severity is Medium, indicating a significant risk if the vulnerability is leveraged. No official patch or workaround is listed, so updating the browser is the primary mitigation strategy.
Debian DSA