Insufficient enforcement of policy in Chrome's Developer Tools allows an attacker who convinces a user to install a malicious extension to elevate its privileges. The attacker can manipulate the extension to obtain elevated privileges within the browser context. This weakness is indicated by CWE-266 and CWE-693, reflecting a failure to enforce least‑privilege controls and a defect in protection mechanisms.

Google Chrome versions prior to 151.0.7922.72 on any supported platform are affected. The issue applies to the Chromium‑based browser used by Google Chrome. Users on or above 151.0.7922.72 are not impacted.

The CVSS score of 8.8 signals high severity, while the EPSS score is less than 1%, indicating a low current likelihood of exploitation; it is not listed in the CISA KEV catalog. The attack requires social engineering to convince a user to install a malicious Chrome extension. Once installed, the extension can exploit the DevTools policy lapse to elevate privileges within the browser session. Based on the description, the likely attack vector involves a crafted extension that bypasses policy checks to gain elevated access.