This vulnerability originates from an incorrect authorization check in a Google Chrome API. Because the check is missing, a remote attacker can craft a malicious Chrome extension that gains privileges beyond what a legitimate extension should have. This allows the attacker to bypass normal system access restrictions that Chrome normally enforces on extensions, effectively providing unauthorized access to the user’s device. The core weakness is an authorization flaw as identified by CWE-863.

Google Chrome browsers built prior to version 157.0.8103.38 are affected. The vulnerability applies to all Chrome builds accessed through the stable channel that have not yet received the patch mentioned in the official release notes.

The CVSS score is not listed, and EPSS data is unavailable, so quantitative risk remains uncertain. However, because the flaw permits bypassing Chrome’s extension permissions entirely, a remote attacker could gain privileges on any user who installs an attacker‑controlled extension. The vulnerability is not currently in the CISA KEV catalog, but its medium severity designation in Chromium’s security logs suggests that it is significant. The likely attack vector is via a crafted extension that the victim unknowingly installs, making this risk high for users who install extensions from unverified sources.