An attacker who convinces a user to install a malicious Chrome extension can exploit insufficient validation of untrusted input in DevTools to perform privilege escalation. The flaw allows the extension code to bypass normal security checks and gain elevated privileges, potentially enabling the attacker to modify system settings, read local data, or execute additional code with higher authority. The weakness is characterized by CWE‑20 (Improper Input Validation) and CWE‑807 (Improper Validation of User‑Controlled Data).

The vulnerability affects Google Chrome versions prior to 151.0.7922.72. Users running these versions on any supported platform are at risk until the Chrome update is applied. No other vendors or Chrome‑derived browsers are listed as affected.

The CVSS score of 8.8 indicates a high severity, while the EPSS score of less than 1% suggests a low probability of real‑world exploitation at present. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector requires social engineering or a malicious website to persuade the user to install a tainted extension, after which the extension can abuse DevTools to elevate privileges. The exploit does not seem to require vicarious network traffic or requiring remote code execution via a network vector; it hinges on the user’s willingness to accept the extension.