An authorization flaw in Chrome extensions allows a remote attacker to bypass the normal system access controls and reach privileged pages by serving a specially crafted HTML page. The weakness permits an attacker who can influence the browser to navigate to or load malicious content to directly open pages that users otherwise cannot access, effectively escalating privileges within the browser environment.

Google Chrome versions prior to 153.0.8010.36 are affected. Users of any Chrome deployment that installs extensions before this version may be vulnerable.

The advisory lists Chromium security severity as Low, and the vulnerability is not in CISA’s KEV catalog, indicating no known active exploitation. No EPSS score is available, so the likelihood of exploitation cannot be quantified from current data. Nonetheless, because the flaw enables unauthorized access to privileged pages, it is recommended to treat the vulnerability as a low‑severity but still actionable risk, until an update is applied or a mitigation is enforced.