This vulnerability (CVE-2026-10997) affects Google Chrome versions before 149.0.7827.53 and is caused by insufficient policy enforcement in the Extensions component. An attacker who persuades a user to install a crafted malicious extension can bypass discretionary access control mechanisms, potentially leading to unauthorized actions within the browser environment. The CVSS 3.1 base score is 6.5 (medium), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact. The vendor advisory linked does not explicitly state patch or remediation status, but the affected version indicates the issue is fixed in 149.0.7827.53.

The vulnerability allows bypassing discretionary access control via malicious Chrome extensions, potentially enabling unauthorized modification or actions within the browser. There is no impact on confidentiality or availability. The integrity impact is high, meaning attackers could alter data or behavior in the browser environment. No known exploits in the wild have been reported.

The vulnerability is fixed in Google Chrome version 149.0.7827.53. Users and administrators should update to this version or later to remediate the issue. Since no explicit vendor advisory states otherwise, applying this update is the recommended mitigation. No additional vendor-provided mitigations or temporary fixes are noted.