Technical impact
An inappropriate implementation of Chrome extensions allows an attacker who convinces a user to install a malicious extension to elevate privileges beyond the normal user level. The vulnerability enables the crafted extension to perform actions that would normally be restricted, potentially affecting the host system or other local applications. The impact is a direct escalation of user privileges, which can lead to unauthorized data access or system compromise, as the extension executes with the privileges of the logged‑in user.
Affected Systems
Google Chrome versions prior to 149.0.7827.53 on any supported operating system are affected. The vulnerability exists in the extensions subsystem of Chrome and does not depend on specific platform features.
Risk and Exploitability
The EPSS score is < 1% and Chrome is not listed in the CISA KEV catalog, suggesting that large‑scale exploitation has not been publicly documented. However, the vulnerability is classified as low severity by Chromium and carries a CVSS score of 6.3, indicating medium severity by the standard metric, and still allows privilege escalation if user interacts with a malicious extension. The risk therefore remains primarily dependent on user behavior and the presence of high‑trust extensions installed from unverified sources.
Debian DSA