Insufficient policy enforcement in Google Chrome extensions allows an attacker who convinces a user to install a malicious extension to bypass discretionary access control. The crafted extension can acquire privileges beyond those intended for an extension, potentially enabling the attacker to read, modify, or delete user data and execute restricted operations.

Google Chrome versions prior to 149.0.7827.53 are affected. No additional vendor or product details are listed.

The vulnerability is exploitable once a user installs a malicious extension; the attacker must otherwise convince the user to do so. No EPSS score or KEV designation is available, so the likelihood of exploitation is unclear. The CVSS score is not provided, but the Chromium security severity is Medium, indicating a significant risk if the vulnerability is leveraged. No official patch or workaround is listed, so updating the browser is the primary mitigation strategy.