Chrome extensions without proper authorization checks enable a remote attacker to inject and run arbitrary code inside the browser sandbox. This flaw permits a crafted extension, once installed by a user, to execute in the same isolated environment as the browser, potentially accessing local data, making network requests, or interacting with browser APIs. The weakness is classified as CWE‑862 (Missing Authorization). The malicious code does not escape the sandbox, but within that boundary it can compromise confidentiality and integrity of local data and network communications.

The vulnerability impacts Google Chrome on all operating systems for versions before 156.0.8078.47. Users running an unpatched Chrome installation that install or enable an untrusted extension are susceptible.

The CVSS score of 8.8 reflects a high severity. The EPSS score of less than 1% indicates a very low likelihood of widespread exploitation at this time. Attackers can exploit this remotely by influencing a user to install a malicious extension; no local credentials or privileges are required to create the threat because the attack vector is social engineering. The flaw is not listed in the CISA KEV catalog. Once the extension is installed, it can execute sandboxed code that may read sensitive information or perform other malicious actions within the browser context.