A weakness in how Chrome applies extension policies before version 151.0.7922.72 allows a malicious extension to replace a crafted domain name and gain privileges that should be restricted by discretionary access control. The flaw is an improper access control issue (CWE‑284) that lets an attacker that successfully convinces a user to install a harmful extension elevate its privileges within the browser. The impact is that the attacker could access or modify data, perform actions, or execute code within the user’s browser context that would normally be disallowed.

All users running Google Chrome earlier than version 151.0.7922.72 are affected, regardless of the operating system. The vulnerability applies to the desktop stable channel listed in the security announcement for that release.

The CVSS score of 4.3 indicates a low overall severity, and the EPSS score of less than 1 % suggests a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector requires a user to install a malicious extension, which can be achieved through phishing, social engineering, or driverless downloads. Once installed, the attacker can subvert the discretionary access control enforced by Chrome. Because the flaw involves policy enforcement, attackers can bypass restrictions on a domain name crafted to meet extension requirements, enabling unauthorized actions. The combination of low CVSS but potential for persistence makes endpoint administrators prudent to address the issue as soon as an update becomes available.