An inappropriate implementation of Chrome extensions allows an attacker who convinces a user to install a malicious extension to elevate privileges beyond the normal user level. The vulnerability enables the crafted extension to perform actions that would normally be restricted, potentially affecting the host system or other local applications. The impact is a direct escalation of user privileges, which can lead to unauthorized data access or system compromise, as the extension executes with the privileges of the logged‑in user.

Google Chrome versions prior to 149.0.7827.53 on any supported operating system are affected. The vulnerability exists in the extensions subsystem of Chrome and does not depend on specific platform features.

The EPSS score is not available and Chrome is not listed in the CISA KEV catalog, suggesting that large‑scale exploitation has not been publicly documented. However, the vulnerability is classified as low severity by Chromium, indicating that while the attack requires user interaction (installing a malicious extension), it still allows privilege escalation if successful. The risk therefore is largely dependent on user behavior and the presence of high‑trust extensions installed from unverified sources.