An insufficient policy enforcement bug in Chrome’s DirectSockets component permits a crafted Chrome Extension to manipulate the browser’s communication channel, enabling arbitrary reading and writing of data within the browser process. The flaw is associated with both CWE‑1220 (Insufficient Policy Enforcement) and CWE‑20 (Improper Input Validation), allowing a remote attacker—assuming the user installs the malicious extension—to access sensitive information or inject harmful content, thus compromising user data and browser integrity.

Google Chrome desktop releases earlier than version 148.0.7778.96 are affected. No other Google products or third‑party browsers are currently known to be impacted.

The vulnerability requires the user to install a specially crafted extension, after which the attacker can read or modify data without further privileges. Because the EPSS score is 0.038% and the issue is not listed in CISA/KEV, the principal indicators of risk are the medium CVSS score of 5.4 and Chromium’s Medium severity rating. The attack vector is user interaction combined with the malicious extension, reducing the bandwidth of successful exploitation to scenarios where the user grants the extension permission.