An insufficient policy enforcement bug in Chrome’s DirectSockets component allows a crafted Chrome Extension to manipulate the browser’s communication channel, enabling arbitrary reading and writing of data within the browser process. Classified as CWE‑20, a boundary‑check failure, this flaw permits a remote attacker—provided the user installs the malicious extension—to access sensitive information or inject harmful content, compromising user data and browser integrity.

Google Chrome desktop releases earlier than version 148.0.7778.96 are affected. No other Google products or third‑party browsers are currently known to be impacted.

The vulnerability requires the user to install a specially crafted extension, after which the attacker can read or modify data without further privileges. Because the EPSS score is not available and the issue is not listed in CISA/Kev, the principal indicators of risk are the medium CVSS score of 5.4 and Chromium’s Medium severity rating. The attack vector is user interaction combined with the malicious extension, reducing the bandwidth of successful exploitation to scenarios where the user grants the extension permission.