Google Chrome contains a CWE‑20 input validation weakness in its extension handling. This flaw allows a remote attacker to send specifically crafted network traffic to the browser, bypassing its built‑in web origin policy and causing the browser to load a privileged page as if it were a trustworthy origin. The flaw could expose sensitive data or enable the execution of arbitrary code within the browser context, potentially compromising the user’s system. According to Chromium, the security severity is Low.

All desktop installations of Google Chrome that used a version earlier than 153.0.8010.36 are affected. The vulnerability exists in the core browser code that processes extension‑generated network requests on Windows, macOS, and Linux platforms.

The CVSS score is listed as Low in the Chromium security database, and no EPSS data or KEV listing is available. Despite the low severity rating, the attack vector is remote and only requires the attacker to send crafted traffic to a Chrome instance that has the vulnerable extension enabled. The vulnerability could be abused by a threat actor who can route traffic to the target browser, making it a non‑trivial risk until the patch is applied.