A confused deputy vulnerability in Google Chrome’s DevTools before version 156.0.8078.47 lets a remote attacker manipulate a user into installing a malicious Chrome extension. Once installed, the extension exploits a flaw in DevTools that allows the attacker to read sensitive information from the user’s environment. The flaw does not grant direct code execution but enables unauthorized disclosure of data.

All installations of Google Chrome up to version 156.0.8078.46 are affected. Versions 156.0.8078.47 and later contain the fix that resolves the issue in DevTools.

The vulnerability receives a CVSS score of 8.8, indicating high severity. The EPSS score is below 1%, and it is not listed in the CISA KEV catalog. Attackers must first socially engineer a user to install a crafted extension; once installed, the extension can read sensitive data. Thus the exploitation requires a user action and is limited to those who install the attacker’s malicious add‑on.