Technical impact
A violation of policy enforcement in the DevTools component of Google Chrome permits an attacker to cause a user, after the user has installed a malicious extension, to expose data from a different origin. The flaw allows the extension to bypass normal same‑origin restrictions and read content that should be inaccessible, thereby constituting an information disclosure vulnerability. The weakness is an inadequate enforcement of access controls on DevTools‑related APIs, and it can lead to the leak of sensitive information to an attacker.
Affected Systems
This issue affects Google Chrome installations on Windows, macOS, and Linux that are prior to version 149.0.7827.53. Users running earlier versions remain vulnerable. No third‑party products are listed.
Risk and Exploitability
The vulnerability has a CVSS score of 4.3 and an EPSS score of less than 1%, and it is not listed in CISA's KEV catalog. It is classified as medium severity in Chromium. Attackers would need to persuade a user to install a malicious extension and then rely on the DevTools policy gap to read cross‑origin data. Exploitation requires the user to have enabled the extension, so while the threat exists, the probability of exploitation in the wild is uncertain but non‑zero. Given the lack of public exploitation reports, the risk remains moderate; however, the potential for confidential information leakage warrants prompt mitigation.
Debian DSA