This vulnerability involves insufficient enforcement of extension policies in Google Chrome versions before 149.0.7827.53. It allows an attacker to bypass discretionary access controls by tricking a user into installing a malicious extension, potentially enabling unauthorized actions within the browser environment. The issue is specific to the extension system and does not affect cloud services. The Chromium security team rates this as medium severity. No CVSS score is assigned, and no known exploitation has been observed. The vendor advisory points to a stable channel update that presumably includes a fix.

If exploited, this vulnerability could allow a malicious Chrome extension to bypass discretionary access controls, potentially leading to unauthorized access or actions within the browser context. However, exploitation requires user interaction to install the malicious extension. There are no reports of active exploitation in the wild.

Google has released a stable channel update for Chrome version 149.0.7827.53 that addresses this vulnerability. Users and administrators should update to this version or later to remediate the issue. Since this is a client-side application, patching the browser is the primary mitigation. No additional vendor advisories indicate alternative mitigations or that no action is required.