Technical impact
The vulnerability stems from inadequate policy enforcement within DevTools in Google Chrome prior to version 149.0.7827.53. An attacker that can persuade a user to install a malicious extension can abuse this flaw to elevate privileges, as the crafted extension bypasses internal security checks. This granting of higher privileges can allow the attacker to execute privileged operations on the host system, compromising confidentiality, integrity, and availability of data stored or accessed by the browser.
Affected Systems
Google Chrome browsers on all platforms that run a version older than 149.0.7827.53 are potentially impacted. The affected product is Google Chrome itself, where the policy enforcement check was part of the DevTools module.
Risk and Exploitability
The vulnerability is reported with a CVSS score of 8.8 and an EPSS score of less than 1%; it is not listed in the CISA KEV catalog. Because the exploit requires a user to install a malicious extension, the attack vector is social engineering. The exploit is potentially feasible if a user is deceived into installing an extension from an untrusted source. With an EPSS score of <1% and no entry in KEV, the precise likelihood of exploitation remains uncertain, yet the nature of privilege escalation warrants prompt mitigation.
Debian DSA