An incorrect authorization flaw in Google Chrome’s Extensions component, affecting versions prior to 156.0.8078.47, enables a remote attacker to bypass system access restrictions by deploying a crafted Chrome extension. The flaw allows the attacker to execute arbitrary code within the browser sandbox, potentially leading to system compromise if further privilege escalation is achieved. The vulnerability is identified as an incorrect authorization flaw (CWE‑863).

Google Chrome versions prior to 156.0.8078.47 on desktop platforms are affected. The flaw manifests in the Extensions component, impacting any user who has enabled Chrome extensions and installs or triggers a malicious extension.

The CVSS score for this defect is 8.8, indicating high risk. The EPSS score of < 1% indicates a very low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a malicious Chrome extension, requiring social engineering to get the user to install or otherwise trigger the extension, thus exposing the vulnerable browser instance to unauthorized code execution.