The vulnerability is an incorrect authorization flaw in the Chrome extensions subsystem (CWE‑863). A crafted extension can bypass Chrome’s normal system‑access restrictions, allowing the extension to access privileged operations on the host. The flaw exists in all Chrome releases older than 156.0.8078.47.

Affected products are Google Chrome, all build versions older than 156.0.8078.47. The issue is confined to the extensions component and does not impact other browser features directly.

The CVSS score of 9.6 marks the flaw as critical, while the EPSS score of < 1 % indicates a very low likelihood of exploitation at present. However, the vulnerability requires a user to install or load a malicious extension, which constitutes a user‑interaction prerequisite. Based on the description, it is inferred that once the extension is installed, the attacker can gain system‑level access or execute code outside Chrome’s sandbox. The flaw is not listed in the CISA KEV catalog, but the high severity warrants prompt remediation.