The vulnerability allows an attacker to bypass Chrome's built‑in authorization controls for extensions, enabling a malicious extension to perform privileged actions that normally would be restricted. This weakness, classified as CWE‑863, can lead to unauthorized operations on the host system. The impact extends to confidentiality, integrity, and availability when the attacker can gain elevated privileges through the compromised extension.

Google Chrome versions prior to 157.0.8103.38 are affected. The issue is limited to desktop builds of the stable channel where the version check is insufficient to prevent installation of extensions crafted by remote actors.

No EPSS value is available; the risk of exploitation cannot be quantified but the problem is listed as Medium severity by Chromium. Because the attack requires social engineering to trick a user into installing a malicious extension, the likelihood hinges on user susceptibility rather than a direct exploitation vector. The vulnerability is not currently listed in the CISA KEV catalog, indicating no known active exploits at the time of publication.