The vulnerability stems from insufficient enforcement of the policy that governs Chrome extensions, an instance of improper input validation (CWE‑20). When a user loads a crafted HTML page from a compromised renderer process, the browser can bypass the intended isolation of the extension environment and execute privileged code. The flaw enables an attacker to perform actions within the browser that normally require higher privileges, thereby elevating their capabilities on the local machine.

Google Chrome versions prior to 150.0.7871.47 are affected. No official workaround is provided by Google.

The CVSS score of 7.5 indicates a high severity assessment, while the EPSS score of less than 1% suggests that exploitation is currently unlikely. The vulnerability is not listed in the CISA KEV catalog. An attacker must first achieve a compromise of the renderer process and then serve a crafted HTML page to elevate privileges within the browser process. The attack vector is inferred to require remote delivery of malicious content to a compromised renderer.