The vulnerability is an incorrect authorization flaw in a Chrome API that allows a remote attacker, through social engineering, to bypass system access restrictions by installing a crafted Chrome extension. This flaw gives the attacker elevated privileges within the browser context, potentially allowing access to protected user resources or system‑wide actions if further exploitation is achieved. The weakness aligns with CWE-863.

Google Chrome versions prior to 156.0.8078.47 are affected. Any user or organization running an older Chrome build that exposes the vulnerable API to untrusted content or extensions is at risk. The issue applies to all platforms where Chrome’s stable channel was running the pre‑156.0.8078.47 build.

The flaw carries a CVSS score of 8.8, indicating high severity. The EPSS score is < 1%, suggesting limited exploitation probability in the wild. The vulnerability is not listed in the CISA KEV catalog. The most likely attack vector involves a malicious or socially engineered Chrome extension that abuses the improperly authorized API to gain elevated privileges. Exploitation requires user action to install or run the extension but could otherwise propagate further intrusion attempts from the compromised browser.