An authorization error in Chrome’s DevTools allows a remote attacker to bypass the web origin policy. By delivering a specially crafted Chrome extension, the attacker can read or interact with data from origins that would normally be blocked, enabling potential exfiltration of confidential information. This flaw is a classic example of missing access control (CWE‑863) and, because it exploits the web origin policy, it directly undermines the same‑origin security boundary.

Google Chrome browsers prior to version 154.0.8037.57 are affected. Users running Chrome 154.0.8037.57 or newer have the issue corrected.

The CVSS score of 5.4 indicates a low severity vulnerability and the EPSS score is < 1%, suggesting a very low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Attackers would normally rely on social engineering to entice a user into installing a malicious extension; once the extension is installed it can exploit the DevTools authorization flaw to read data from disallowed origins. The risk is heightened in environments where users are prone to phishing or unaware of extension permissions.