This vulnerability arises from an inappropriate implementation in the Extensions system of Google Chrome before version 149.0.7827.53. An attacker who convinces a user to install a crafted malicious extension can bypass discretionary access control mechanisms, potentially leading to unauthorized modification or interference with browser behavior or data. The CVSS 3.1 base score is 6.5, reflecting a network attack vector with low attack complexity, no privileges required, but user interaction needed, and an impact limited to integrity. The vendor advisory link is provided but does not specify a fix or mitigation status.

Successful exploitation allows an attacker to bypass discretionary access controls via a malicious Chrome extension, potentially compromising the integrity of the browser environment. There is no impact on confidentiality or availability reported. No known active exploits have been observed.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for current remediation guidance. Until an official fix is confirmed, users should avoid installing untrusted extensions and follow best practices for extension management.