An incorrect authorization check in Chrome Extensions enabled a remote attacker who had already succeeded in compromising the renderer process to construct a malicious HTML page that bypassed the browser’s sandbox and executed code outside the intended boundaries. The flaw is categorized as CWE‑863, an authorization weakness that fails to restrict access to a specific resource and carries a Chromium medium severity rating.

The affected product is Google Chrome with versions prior to 157.0.8103.38. Users running any Chrome build before this release on Windows, macOS, or Linux desktops are susceptible if they load extensions that allow executing renderer code.

The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, because the attack requires an initial compromise of the renderer process, the exploitability is moderate to high if such a foothold is achieved. An attacker who can deliver crafted HTML content to the compromised renderer can trigger the flaw and run code outside the sandbox, posing a serious threat to confidentiality, integrity, and availability of the affected system.