Insufficient policy enforcement in Chrome extensions permits a maliciously crafted extension to disable the browser’s content security policy, thereby allowing arbitrary script execution and data exfiltration. The flaw arises when an attacker convinces a user to install an extension, after which the extension can perform privileged actions normally protected by CSP. This weakness directly undermines the integrity and confidentiality guarantees normally supplied by the browser and can be used for phishing, credential theft, or installation of additional malware.

Google Chrome, any version older than 149.0.7827.53, is affected. The vulnerability is present in the stable channel of all operating systems that run Chrome up to this version.

The flaw is considered low in Chromium severity but can be actively exploited once a user installs the malicious extension. Because the attack requires user interaction, the attacker’s access vector is user‑constrained. The exploit probability is not quantified (EPSS unavailable) and the vulnerability is not listed in CISA KEV. Nonetheless, any organization using Chrome on end‑users should treat it as a risk if no patch is applied.