This vulnerability arises from an inappropriate implementation in the Extensions component of Google Chrome. Prior to version 149.0.7827.53, a remote attacker who had already compromised the renderer process could craft a malicious HTML page that would trigger privilege escalation. The flaw, classified as CWE‑20 (Improper Input Validation) and CWE‑358 (Use of a Variable in a Invariant Condition), allows the attacker to elevate privileges beyond the intended scope, potentially compromising system integrity. Because the effect requires renderer‑level compromise, successful exploitation demands that the attacker first gain some foothold within the browser’s rendering engine.

Google Chrome versions earlier than 149.0.7827.53 are affected. This impact applies to all Chrome desktop installations that include the built‑in extensions framework.

The CVSS score is 7.5, and the EPSS score is < 1%, indicating a very low probability of exploitation. Chromium security severity is marked as Low. The vulnerability is not listed in the CISA KEV catalog, suggesting it has not been observed in widespread use. Nonetheless, the exploit requires a prior renderer compromise, making it less likely to be exploited in the wild compared to pure remote attacks. For systems that have not yet applied the 149.0.7827.53 update, the risk remains that a local or local privileged attacker could leverage the flaw for privilege escalation. The attack vector, therefore, is primarily local with the prerequisite of renderer process compromise.