Insufficient policy enforcement in Chrome DevTools allows a malicious extension to modify cookies on domains that are normally restricted by enterprise policies. The vulnerability is described as a flaw that enables an attacker who convinces a user to install a malicious extension to bypass enterprise host restrictions for cookie modification via a crafted Chrome Extension.

The flaw affects all Chrome stable channel releases prior to 147.0.7727.55 on desktop platforms, including Windows, macOS, and Linux. Patches are available in the latest stable update and are noted in the Google Chrome release blog.

The severity is classified as low by Chromium. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attacker must first persuade a user to install a malicious extension, after which the compromised cookies can be written, deleted, or changed. The risk level is moderate as it requires social engineering and targeted extension installation, but the impact of cookie tampering can potentially influence session state and related data.