This vulnerability arises from improper input validation in the DevTools component of Google Chrome versions before 149.0.7827.53. An attacker who persuades a user to install a crafted malicious extension could exploit this flaw to leak data across origins, violating the same-origin policy. The issue is specific to Chrome desktop and does not affect cloud services. The vendor has released an update in Chrome version 149.0.7827.53 to address this vulnerability.

Successful exploitation could lead to unauthorized disclosure of cross-origin data through a malicious Chrome extension. This compromises user data confidentiality within the browser context. No evidence of active exploitation is reported, and the impact is limited to users who install malicious extensions.

Users and administrators should update Google Chrome to version 149.0.7827.53 or later, where this vulnerability is fixed. Since this is a client-side application, patching the browser is the primary remediation. There is no indication from the vendor advisory that additional mitigation steps are required beyond applying the official update.