The vulnerability is an inappropriate implementation in Chrome extensions that lets a remote attacker embed arbitrary scripts or HTML pages within a crafted web page. This enables a cross‑site scripting attack that can execute JavaScript in the context of the browser or mislead users with malicious content. The weakness is identified as CWE‑79 and could lead to theft of credentials, session hijacking, or further exploitation within the user’s operational environment.

Google Chrome versions prior to 151.0.7922.72 on all supported operating systems are affected. The issue is confined to the browser’s extension framework and does not directly involve the underlying OS or other system components.

The CVSS score of 5.4 indicates a moderate severity vulnerability, while the EPSS score of <1% suggests a low current exploitation probability. The issue is not listed in the CISA KEV catalog. The attack vector is remote, delivered through a crafted HTML page that a user navigates to. Successful exploitation depends on the browser rendering the crafted content without proper validation, with no additional prerequisites beyond normal web browsing.