The flaw is an incorrect authorization in the Chrome extension subsystem of Google Chrome prior to build 156.0.8078.47, allowing a remote attacker to bypass system access restrictions via a crafted extension. An attacker can provide a malicious extension that reads or manipulates data normally protected by the browser’s security model, such as browsing history, cookies, or other local data. The weakness is classified as CWE‑863.

The vulnerability affects Google Chrome versions prior to 156.0.8078.47. Any installation of Chrome before this build is potentially exposed if it has extensions installed with elevated permissions.

Based on the description, it is inferred that the attack vector requires a user to install a malicious extension that exploits the extension’s weak access controls; thus, the attack vector is at least user‑interactive. The CVSS score of 6.5 indicates medium severity, the EPSS score of < 1% suggests a very low exploitation probability, and it is not listed in the CISA KEV catalog. The potential impact remains limited to information disclosure but could be significant if sensitive data is accessed.