The flaw lies in Chrome’s insufficient enforcement of extension policies in versions before 151.0.7922.72. A compromised extension can be engineered to override navigation restrictions, allowing an attacker to redirect users to malicious or phishing sites even when the browser’s built‑in navigation controls are active. This weakness is identified as a policy enforcement flaw (CWE-807).

All users of Google Chrome before release 151.0.7922.72 are affected, regardless of operating system, as the issue is in the core browser code and not tied to any specific platform.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation at present. The vulnerability is not listed in CISA KEV. Attackers must first persuade a user to install a malicious extension; once installed, the extension operates with the user’s privileges and can manipulate navigation calls. No remote code execution or privileged escalation is required, and the attack relies on social engineering rather than a remote attack vector.