The vulnerability arises from a missing authorization check in Chrome Extensions prior to 156.0.8078.47. An attacker who can supply a crafted Chrome extension can cause the browser to access cross‑origin data that the user would normally not be able to read. This privileged data access can expose sensitive information or be used to facilitate further attacks. The flaw does not explicitly allow code execution, but the ability to read protected resources is a significant breach of confidentiality.

All deployments of Google Chrome before the latest release are affected. No other vendors or products are listed in the CNA data.

The CVSS score of 8.8 indicates a high‑severity vulnerability. The EPSS score of < 1% shows a very low probability that this flaw will be exploited in the wild, but the risk remains because the flaw is remote and allows attackers to access sensitive cross‑origin data. The vulnerability is not listed in CISA’s KEV catalog, so there is no known exploitation activity currently. To exploit it, an attacker must supply a malicious extension or a crafted page that harnesses the Chrome extension system, and the victim must allow the extension to run in the browser.