Google Chrome implements Regional Capabilities that control what a browser can access on the system. The CVE exposes improper privilege management in those capabilities, so a crafted Chrome extension can bypass the intended restrictions. An attacker who convinces a user to install a malicious extension can therefore gain privileges that exceed the browser’s normal sandbox, potentially allowing broader system access.

All installations of Google Chrome on any supported operating system with versions earlier than 152.0.7977.65 are affected. The issue pertains to the desktop channel of Chrome where the older Regional Capabilities implementation was used.

The Chromium severity assessment rates the issue as Medium, but the CVSS score of 8.8 classifies it as high severity. No public exploit is documented as of the latest advisories. The EPSS score indicates a very low exploitation probability (< 1%). The vulnerability is not listed in the KEV catalog. The risk remains moderate due to the requirement for social engineering to install the malicious extension, although the potential impact is high once the extension is installed.