Inappropriate implementation in the Chrome Extensions component allows a malicious extension crafted by an attacker with privileged network access to run arbitrary code within the browser’s sandbox. The flaw can enable code that may be used to compromise the system beyond the sandbox, depending on host configuration and additional vulnerabilities. This weakness represents improper permission handling that permits code execution where it should be disallowed. The flaw carries a low severity rating by Chromium security practices, indicating limited immediate impact but potential for escalation if coupled with other weaknesses.

Google Chrome versions older than 149.0.7827.53 are affected. The issue appears in the stable channel release for desktop prior to that build. No other Chrome products or major components are reported as impacted.

The CVSS score is not provided, and the vulnerability is not listed in the CISA KEV catalog, implying no widespread exploitation has been observed. An attacker would need privileged network access to deliver a malicious extension, making public exploitation unlikely. The impact of any successful exploit remains confined to the sandbox, though it can serve as a pivot toward higher-level compromise if additional host weaknesses exist.