The vulnerability stems from inadequate policy enforcement within DevTools in Google Chrome prior to version 149.0.7827.53. An attacker that can persuade a user to install a malicious extension can abuse this flaw to elevate privileges, as the crafted extension bypasses internal security checks. This granting of higher privileges can allow the attacker to execute privileged operations on the host system, compromising confidentiality, integrity, and availability of data stored or accessed by the browser.

Google Chrome browsers on all platforms that run a version older than 149.0.7827.53 are potentially impacted. The affected product is Google Chrome itself, where the policy enforcement check was part of the DevTools module.

The vulnerability is listed with a medium Chromium internal severity, but no external CVSS or EPSS score is available. Because the exploit requires a user to install a malicious extension, the attack vector is social engineering. The exploit is potentially feasible if a user is deceived into installing an extension from an untrusted source. With no EPSS or KEV information, the precise likelihood of exploitation remains uncertain, yet the nature of privilege escalation warrants prompt mitigation.