An authorization flaw in Chrome extensions allows a remote attacker to bypass the normal system access controls and reach privileged pages by serving a specially crafted HTML page. The weakness permits an attacker who can influence the browser to navigate to or load malicious content to directly open pages that users otherwise cannot access, effectively escalating privileges within the browser environment.

Google Chrome versions prior to 153.0.8010.36 are affected. Users of any Chrome deployment that installs extensions before this version may be vulnerable.

The advisory lists Chromium security severity as Low, but the CVSS score of 9.8 indicates a severe flaw. The vulnerability is not in CISA’s KEV catalog, and the EPSS score is less than 1%, indicating a low likelihood of exploitation at present. Nonetheless, because the flaw enables unauthorized access to privileged pages, it is recommended to treat the vulnerability as a high‑severity but actionable risk until an update is applied or a mitigation is enforced.