The vulnerability is a missing authorization in Google Chrome’s DevTools that enables a local attacker to bypass system access restrictions by installing a crafted Chrome extension. It is identified as CWE-862 and allows an attacker to perform privileged operations that would normally be restricted to a higher level user.

Google Chrome systems running any version earlier than 156.0.8078.47, on all supported platforms, are affected. Users with these versions should upgrade to at least the 156.0.8078.47 release to eliminate the flaw.

The CVSS base score of 9.6 indicates a high severity, while the EPSS score of < 1% shows a low current probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, the most likely attack vector is a local attacker who supplies a malicious extension that takes advantage of the missing authorization to gain elevated access to system resources.