The vulnerability stems from insufficient enforcement of policy settings in the Chrome DevTools console. An attacker who can convince a user to install a malicious extension can use the DevTools JavaScript console to alter cookies on a host that would otherwise be prohibited by enterprise policy. This policy bypass allows the attacker to modify cookie data that should be protected, potentially compromising user privacy or enabling credential stealing. The weakness is represented by CWE‑280 and CWE‑602.

The flaw applies to Google Chrome before version 147.0.7727.55 on all supported operating systems, including Windows, macOS, and Linux. Any user with a susceptible Chrome installation who installs a malicious extension is at risk.

With a CVSS score of 6.5, the vulnerability is considered moderately severe. The EPSS score is reported as less than 1 %, indicating a low overall likelihood of exploitation. Because the attack requires user interaction (installation of an extension) and manual use of DevTools, the real-world exploitability is limited, and the vulnerability is not listed in the CISA KEV catalog.