The flaw is a missing authorization check in the DevTools interface of Google Chrome. A remote attacker, by persuading a user to install a malicious extension, can access DevTools commands that are reserved for privileged pages. This bypasses the browser’s page‑level access restrictions and grants the attacker control over pages that normally require higher security clearance. The vulnerability’s CWE is 862, reflecting an authorization bypass.

The vulnerability applies to Google Chrome versions before 157.0.8103.38 on desktop operating systems. Chromium users with these releases are exposed. The affected product is the standard Chrome browser; versions older than 157.0.8103.38 need upgrading.

The issue is classified as low severity by Chromium, and no EPSS score is available, so the probability of exploitation is currently undocumented. The attack requires a social‑engineering step to convince the user to load a crafted extension, making it less likely than purely automated exploits. It is not listed in the CISA KEV catalog, suggesting no known large‑scale exploitation. Nonetheless, an attacker who succeeds can run DevTools commands on privileged pages, effectively elevating their capabilities within the browser.