An incorrect security UI handling in Google Chrome extensions before version 150.0.7871.47 exposes a user‑experience security flaw that lets a malicious extension inject arbitrary scripts or HTML when a user visits a specially crafted page. This can enable the extension to execute code in the context of the loaded page, potentially leading to data theft, session hijacking, or additional malicious activity.

The flaw affects all desktop installations of Google Chrome running a version older than 150.0.7871.47, regardless of operating system.

Chromium classifies the severity as Medium. No EPSS score is available and the vulnerability is not listed in CISA KEV. Exploitation requires the user to trust and install a malicious extension, after which the user must visit a crafted page. The attack vector is thus social engineering coupled with a crafted web page. Although the rating is medium, the risk is constrained by the need for user interaction and the lack of an automated public exploit.