Incorrect authorization in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass the web origin policy via a crafted Chrome extension. This vulnerability permits injection of malicious code that runs within the extension sandbox, enabling remote code execution while remaining confined to the browser environment. The weakness is related to incorrect authorization and memory corruption (CWE-825, CWE-863). Chromium security severity: Medium.

Google Chrome versions earlier than 156.0.8078.47 are affected. Users running these releases on desktop platforms should consider themselves vulnerable until they upgrade to a patched build.

The CVSS score of 8.8 indicates a high severity, but the EPSS score is < 1% and the vulnerability is not listed in CISA KEV. Exploitation requires a remote attacker to entice the user into installing a malicious extension or to trick the browser into loading a crafted extension that bypasses web origin policy. While the sandbox limits the scope, the attacker can execute code remotely within the extension environment, potentially accessing local data and performing other privileged browser actions.