Google Chrome DevTools performed an incomplete cleanup before 157.0.8103.38. A crafted Chrome extension could exploit this flaw to bypass system access restrictions, allowing an attacker to gain higher privileges than intended. The weakness is an Incorrect Removal of Resource, classified as CWE-459.

Google Chrome browsers on all supported platforms running versions earlier than 157.0.8103.38 are affected. Users who install or run malicious extensions while the vulnerable Chrome version is active face risk.

The CVSS base score is not provided, and the EPSS score is unavailable, but the vulnerability is listed as Chromium Security Severity Low and is not present in CISA KEV. The likely attack vector involves a malicious Chrome extension that an end‑user installs; once loaded, the extension could use the incomplete DevTools cleanup to elevate privileges. Without additional access controls, a local or remote attacker who can deliver such an extension can exploit the flaw. The lack of high exploitation statistics means risk is modest, but the impact of privilege escalation warrants attention.