An incorrect authorization in Chrome’s network stack allows a remote attacker to bypass the browser’s web origin policy, a high‑severity flaw that can expose cross‑origin data and potentially let a malicious user steal credentials or inject code. The vulnerability is classified as High severity by Chromium and can be exploited through a crafted Chrome extension rather than the normal web channel. It is a CWE‑863 authorization bypass vulnerability.

Users running Google Chrome versions earlier than 153.0.8010. exists in the network layer and impacts any instance where a user might install a malicious extension trustable by social engineering.

The CVSS score of 6.5 defines this issue as medium severity, and the EPSS score of less than 1% indicates a low likelihood of exploitation. The flaw is not currently listed in CISA’s KEV catalog. Although no public exploits are known, the vulnerability could be leveraged through social engineering to convince users to install a malicious extension. Once installed, the attacker can read or modify cross-origin data.