The vulnerability is an incorrect authorization flaw in Google Chrome extensions that permitted a remote attacker to craft a malicious extension and obtain data from other origins. This flaw could allow an attacker to read sensitive data across websites, compromising confidentiality without requiring direct user interaction beyond installing a malicious extension. The weakness maps to CWE‑863 (Authorization Bypass Through User‑Controlled Key).

Google Chrome desktop installations running any version earlier than 157.0.8103.38 on all supported operating systems are affected.

Chromium labels the vulnerability as Medium severity. No CVSS or EPSS scores are publicly available, and it is not listed in the CISA KEV catalog. Exploitation requires a malicious Chrome extension, so the risk depends on users installing suspicious extensions. While a publicly available exploit is not reported, the potential to read cross‑origin data makes the vulnerability a moderate concern for vulnerable installations.