This vulnerability involves insufficient policy enforcement within Chrome’s DevTools. A malicious extension that a user has been tricked into installing can use crafted code to acquire data from origins that the extension is not normally permitted to access. The attacker gains confidential information by bypassing DevTools’ security controls, illustrating a violation of the confidentiality property of the data it contains. The weakness is classified as CWE‑346, indicating improper control of a resource or parameter through an untrusted output.

Google Chrome versions prior to 151.0.7922.72 are affected. The issue exists in the stable channel of Chrome and would impact any user running one of these versions.

The CVSS score of 4.3 places the vulnerability in the low‑severity range. The EPSS score of less than one percent indicates a very low likelihood that it will be exploited in the wild, and the vulnerability is not listed in the CISA KEV catalog. Exploitation would require an attacker to convince a user to install a malicious extension, so the attack vector is primarily user‑initiated and local. While the impact is limited to data leakage rather than system compromise, the potential for privacy violations warrants attention.