Incorrect authorization in the Extensions component of Google Chrome versions prior to 156.0.8078.47 allows a remote attacker to craft a malicious Chrome extension that can obtain sensitive information from the victim's profile. This flaw permits the attacker to read data that should be protected, potentially exposing confidential content. The vulnerability does not provide arbitrary code execution but grants significant read access within the extension's context.

Google Chrome on all platforms. Versions earlier than 156.0.8078.47 are affected. The vulnerability applies to all users of legacy Chrome releases that have not installed the 156.0.8078.47 update or subsequent patches.

The likely attack vector is a malicious or tampered Chrome extension distributed to users. An attacker could host the extension on a compromised website or use a phishing page to induce a user to install it. Once installed, the extension can exploit the incorrect authorization check to obtain sensitive information from the profile. The EPSS score indicates very low current exploitation probability, but the CVSS of 8.8 shows a high potential impact if exploited. The vulnerability is not listed in CISA KEV, and no public exploit is known, so users should update Chrome promptly and verify that only trusted extensions are installed.