Technical impact
Insufficient policy enforcement in Google Chrome extensions allows a malicious extension, once installed, to bypass the browser’s content security policy. This flaw can undermine the browser’s protection of web content. Based on the description, it is inferred that the attacker may attempt to inject or execute scripts that would otherwise be blocked by CSP, potentially compromising the integrity of web pages loaded in the browser.
Affected Systems
All versions of Google Chrome prior to 149.0.7827.53 on any operating system that supports the browser are affected. The vulnerability exists in the stable channel on every platform running those versions.
Risk and Exploitability
The attack requires a user to install a malicious extension, so it is user-constrained. The CVSS score is 4.3 and the EPSS score is less than 1%. The vulnerability is not listed in the CISA KEV catalog. While the impact is limited to the browser context, the potential to bypass CSP means that, if the user is tricked into installing an extension, the attacker may be able to run otherwise disallowed scripts, but the exploitability remains confined to that user’s machine.
Debian DSA