An insufficient input validation in DevTools enabled an attacker to obtain cross‑origin data by persuading a user to install a malicious Chrome extension. The flaw allows the attacker to read data that should be protected by the same‑origin policy, compromising the confidentiality of the user’s information. The weakness matches CWE‑20, Improper Input Validation.

The vulnerability affects Google Chrome for any build before 149.0.7827.53. Versions 149.0.7827.53 and later are not affected. Users of any older Chrome build that allow malicious extensions are vulnerable.

The CVE is rated medium severity with a CVSS score of 4.3 and an EPSS score of < 1%, and it is not listed in the CISA KEV catalog. Likely exploitation requires a user to install a malicious extension, so the attack vector is user‑initiated intent. While the vulnerability is not currently flagged as exploited, the inherent confidentiality risk warrants prompt remediation.