Technical impact
This vulnerability in Google Chrome extensions allows an attacker who convinces a user to install a malicious extension to bypass the browser’s same origin policy. By constructing a crafted extension, the attacker can read or write data across origins that normally would be prohibited, enabling potential data theft or site manipulation. The impact is the ability of compromised extensions to exfiltrate sensitive information or inject malicious content into other sites, thereby undermining confidentiality and integrity.
Affected Systems
All installations of Google Chrome running a version prior to 149.0.7827.53 are affected. The vulnerability is tied to the implementation of extensions in those releases; newer versions incorporate the fix. No other vendors or products are listed.
Risk and Exploitability
The exploitation requires a user to install a malicious extension, typically through social engineering or phishing. The EPSS score is less than 1% and the vulnerability is not listed in the CISA KEV catalog, indicating a low exploitation probability, though the CVSS score of 6.5 still reflects a moderate risk. After installation, the extension can bypass origin restrictions, potentially exposing cross‑site data to the attacker.
Debian DSA