This vulnerability in Google Chrome arises from insufficient enforcement of extension policies before version 151.0.7922.72. An attacker can exploit this by tricking a user into installing a malicious extension, which then bypasses discretionary access control mechanisms via a crafted domain name. The issue is classified under CWE-284 (Improper Access Control). The CVSS vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, low integrity impact, and no availability impact.

An attacker who successfully convinces a user to install a malicious extension can bypass discretionary access control policies, potentially leading to unauthorized actions or privilege escalation within the browser environment. However, the impact is limited to integrity and does not affect confidentiality or availability. The overall severity is medium based on the CVSS score of 4.3.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users and administrators should monitor the official Google Chrome stable channel update blog for updates regarding this vulnerability. Until a fix is confirmed, avoid installing untrusted extensions and apply standard caution with extension permissions.