This vulnerability arises from an inappropriate implementation of policy enforcement in Google Chrome's Extensions prior to version 149.0.7827.53. An attacker who convinces a user to install a crafted malicious extension can bypass navigation restrictions intended to limit extension behavior. The issue is classified under CWE-284 (Improper Access Control). The CVSS v3.1 base score is 6.5 (Medium), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact. There is no explicit vendor remediation level or patch link provided in the data, but the affected versions indicate that version 149.0.7827.53 is the fixed version.

The vulnerability allows an attacker to bypass navigation restrictions through a malicious Chrome extension, potentially enabling unauthorized modification or interference with browser navigation behavior. This impacts the integrity of the browser environment but does not affect confidentiality or availability. Exploitation requires user interaction (installing the malicious extension). There are no known exploits in the wild at this time.

Users and administrators should update Google Chrome to version 149.0.7827.53 or later, as this version addresses the vulnerability. Since no explicit vendor advisory states otherwise, applying this update is the recommended remediation. Avoid installing extensions from untrusted sources to reduce risk of exploitation.