The vulnerability is an insufficient validation of untrusted input in Chrome extensions, classified under CWE‑1286 and CWE‑20. An extension that a user installs could contain crafted data that bypasses the browser's security checks, potentially allowing the extension code to escape the Chrome sandbox and gain elevated privileges on the host system.

The flaw affects Google Chrome versions prior to 151.0.7922.72. Any device running a vulnerable Chrome build, regardless of operating system, is at risk if an attacker convinces a user to install a malicious extension.

The CVSS score of 9.6 indicates a critical severity, while the EPSS score of less than 1 % shows that exploitation is currently unlikely at scale. The flaw is not listed in the CISA KEV catalog, but the attack vector is a local user phishing or social engineering effort that results in the installation of a malicious extension. If successfully exploited, it can lead to privilege escalation within the affected system.