The vulnerability is an incorrect authorization flaw in Chrome’s DevTools that allows a malicious Chrome extension, combined with social engineering, to access sensitive information. This flaw falls under CWE‑863 and can compromise confidentiality of the affected user’s data when the extension is installed and run.

Google Chrome versions earlier than 156.0.8078.47 are affected. The issue stems from a defect in the DevTools component and applies to all platforms where Chrome is run.

The CVSS score of 8.8 indicates a high risk to confidentiality and integrity. The EPSS score of <1% suggests a low probability of exploitation in the wild, and the vulnerability is not listed in CISA’s KEV catalog. The flaw can be exploited by an attacker who entices a user to install a malicious Chrome extension that leverages the incorrectly authorized DevTools functionality to read sensitive data; this attack requires social engineering to obtain the extension and does not provide arbitrary code execution.