A missing authorization check in the Extensions framework of Google Chrome prior to 156.0.8078.47 permits a remote attacker, via social engineering, to load a crafted Chrome extension that can read sensitive data from the browser. This flaw is identified as Missing Authorization (CWE‑862) and does not provide arbitrary code execution, but it enables the attacker to obtain confidential information within the browser sandbox, resulting in an information‑disclosure impact.

The vulnerability affects all installations of Google Chrome that have not updated beyond the 156.0.8078.47 release. Version numbers older than that revision are considered vulnerable; any build using the affected Extensions code base is at risk. No further vendor or product filtering is required as the issue is scoped solely to the Chrome browser.

The attack vector is remote, requiring the victim to install or interact with a malicious Chrome extension. The CVSS score of 6.5 and the EPSS score of < 1% indicate that while the vulnerability’s exploitation is possible, the likelihood of a widespread exploit at this time is low. The flaw is not listed in the CISA KEV catalog, and no active exploits have been confirmed. Therefore, the overall risk remains moderate: the vulnerability can expose sensitive data but does not grant system-wide control or privilege escalation.