Missing authorization in the PDF processing component of Google Chrome up to version 157.0.8103.38 allows a remote attacker to craft a malicious PDF that includes a Chrome extension. By exploiting this flaw, the attacker can bypass the browser’s web origin policy and inject code into a privileged page. This effectively grants the attacker elevated privileges and potential access to sensitive data or the ability to execute arbitrary actions within the context of the privileged page. The weakness is categorized as CWE‑862, Unauthorized Access.

The issue affects Google Chrome on desktop platforms running any version earlier than 157.0.8103.38. The update to 157.0.8103.38 and later addresses the missing authorization check in the PDF engine, restoring proper origin enforcement.

There is no EPSS score available for this vulnerability, and it is not listed in the CISA KEV catalog, suggesting that active exploitation is not widely observed. However, the CVE’s Chromium severity rating is Medium and the flaw is remotely exploitable via a crafted PDF and extension. The attacker needs only to deliver the malicious PDF, for example through phishing or malicious websites, and must have the user load a compromised extension to achieve the bypass. Because the defect involves elevated privilege within the browser, the impact is significant if an attacker succeeds, but the lack of known exploitation or wide public availability of the exploit keeps the immediate risk moderate.