The vulnerability is a missing authorization check in Chrome’s DevTools that allows a remote attacker to bypass the browser’s site isolation protection. An attacker must first social‑engineer a user into installing a malicious Chrome extension that, once loaded, can conduct DevTools actions without normal authorization. Because the DevTools interface can be used to access data from other sites, the attacker could read or modify content from isolates that should remain separate. The weakness is a classic missing‑authorization flaw (CWE‑862).

Google Chrome browsers running any version prior to 157.0.8103.38 are affected. Users on the stable channel, as well as any older releases that had not already reached the patched revision, would be vulnerable.

No EPSS score is available, and the issue is not listed in CISA’s KEV catalog, but Chromium classifies it as low severity. The most likely attack vector requires social engineering to drive a user to install a crafted extension that exploits the missing authorization check. Because the attack depends on a user installing a malicious extension, the exploitation probability is comparatively low, yet the potential to break site isolation boundaries makes the impact significant if the attack succeeds.