An insufficient input validation in DevTools enabled an attacker to obtain cross‑origin data by persuading a user to install a malicious Chrome extension. The flaw allows the attacker to read data that should be protected by the same‑origin policy, compromising the confidentiality of the user’s information. The weakness matches CWE‑20, Improper Input Validation.

The vulnerability affects Google Chrome up to and including version 149.0.7827.52. Versions 149.0.7827.53 and later contain the fix and are not affected. Users of any Chrome build before that are susceptible if they allow malicious extensions to run.

The CVE is rated medium severity but no EPSS score is available, and it is not listed in the CISA KEV catalog. Likely exploitation requires a user to install a malicious extension, so the attack vector is user‑initiated intent. While the vulnerability is not currently flagged as exploited, the inherent confidentiality risk warrants prompt remediation.