The vulnerability is a missing authorization flaw in an API in Google Chrome versions before 156.0.8078.47. It allows a remote attacker to bypass system access restrictions through a crafted Chrome extension, potentially enabling the attacker to run arbitrary code or elevate privileges. This weakness is classified as CWE-862.

Affected systems: All Chrome releases prior to version 156.0.8078.47, including stable channel and interim releases that had not reached the 156 series. Users of desktop Chrome should refer to the public release notes for the patch.

The CVSS score of 8.8 indicates high severity, and the EPSS score of <1% suggests a low probability of exploitation. The vulnerability is not listed in CISA KEV. Attackers can trigger the flaw by creating or tricking a user into installing a malicious Chrome extension that invokes the affected API. Successful exploitation could allow execution of code with the browser process’s privileges, potentially leading to data compromise or further privilege escalation.