A flaw in the authorization checks for Chrome extensions in Google Chrome versions earlier than 156.0.8078.47 (CWE-863: Incorrect Authorization) allows a remote attacker, by using social engineering techniques, to supply a crafted extension that can access privileged data or functionality that it should not have. This incorrect authorization can enable the attacker to read or modify sensitive information stored by the browser or other extensions, effectively bypassing the expected isolation boundaries. The vulnerability is rated as a medium severity in Chromium's internal assessment but carries a CVSS score of 8.8, indicating a high impact if exploited.

Google Chrome versions prior to 156.0.8078.47 are vulnerable. Any installed Extension that accesses the affected API is at risk. The issue affects all platforms where Chrome runs the vulnerable version with the Extension feature enabled.

The CVSS score of 8.8 indicates a high severity, while the EPSS score is less than 1 percent, suggesting a low probability of widespread exploitation, and the vulnerability is not listed in the CISA KEV catalog. Based on the new description, the likely attack vector is a social engineering campaign that entices users to install a malicious extension from a deceptive site or through a phishing link. Once installed, the extension could read or modify sensitive user data or the state of other extensions, potentially compromising data confidentiality and integrity. Exploitation does not require remote code execution within the browser sandbox, but the unauthorized access to privileged data represents a significant security risk.