The vulnerability arises from improper enforcement of discretionary access controls in Chrome’s extensions subsystem. When a user installs an extension that a threat actor convinces them to, the browser’s access‑control checks can be bypassed, allowing the extension to alter data or execute privileged operations beyond its intended scope. The weakness is an inadequacy in authorization handling, as categorized by CWE-266 and CWE-284, and it is classified by Chromium with a medium severity.

Google Chrome desktop clients running any version before 149.0.7827.53 are affected. The issue applies across Windows, macOS, and Linux where Chrome extensions are supported.

The primary entry vector is inferred to be social engineering combined with a local installation action, as an attacker must first persuade a user to install a malicious extension. Because the vulnerability requires direct user interaction, the probability of widespread automated exploitation is low, supported by an EPSS score of <1%. The CVSS score of 6.5 indicates a medium risk, and the vulnerability is not listed in the CISA KEV catalog. The ability to bypass discretionary controls represents a significant risk if unverified extensions are installed.