The vulnerability in Google Chrome’s DevTools arises from a missing authorization check that allows a crafted Chrome extension to access privileged pages. An attacker who succeeds in installing a malicious extension on a victim’s browser can use DevTools to bypass normal access restrictions and gain the ability to read or modify data within privileged contexts, effectively elevating their privileges. This flaw is classified as CWE‑862, Missing Authorization, and represents a significant security risk for any user relying on DevTools interactions.

Google Chrome up to version 156.0.8078.46 is affected. All supported operating systems—Windows, macOS, Linux, and other platforms—run vulnerable builds of Chrome, and any users that install extensions from untrusted sources while using those builds are at risk.

The vulnerability has a CVSS score of 8.8, indicating high severity. The EPSS score is less than 1%, showing that exploitation attempts are currently rare. The flaw is not listed in the CISA KEV catalog. Exploitation requires a social engineering step: a user must install a malicious Chrome extension. Once installed, the extension can directly misuse the missing authorization in DevTools to reach privileged pages without executing separate code, leading to privilege escalation.