An insufficient policy enforcement in Chrome DevTools allows a malicious extension, once installed by a user, to access and leak cross-origin data. The flaw is limited to the browser environment and enables a capable attacker to read data that should be isolated by same-origin policy, compromising confidentiality. The vulnerability is rated low severity by Chromium, indicating limited exploitation vectors and impact scope once the malicious extension is trusted by the user. This flaw corresponds to CWE‑693, a security misconfiguration where a system fails to enforce secure policies.

Google Chrome browsers earlier than version 148.0.7778.96 are affected. Users of these versions should be aware that installing third‑party extensions poses a risk of cross‑origin data leakage.

The vulnerability has a low CVSS score and no EPSS data, and it is not listed in the CISA KEV catalog, suggesting a limited exploit likelihood at present. However, the attack requires a user to install a malicious extension, giving the extension permission to read data across origins. Because the flaw resides in DevTools policy enforcement, an attacker can craft a specifically designed extension to leverage this weakness, but broad automated exploitation is unlikely.