This vulnerability arises from insufficient enforcement of security policies in the DirectSockets API within Google Chrome before version 148.0.7778.96. An attacker can exploit this by creating a malicious Chrome Extension that leverages the weakness to perform arbitrary read and write operations, potentially compromising data integrity or confidentiality within the browser context. The issue is recognized by Chromium security with a medium severity rating. No CVSS score or detailed exploit information is provided. The vendor advisory URL is available but does not explicitly state patch or remediation details.

The impact of this vulnerability is the potential for a remote attacker to execute arbitrary read and write operations via a crafted Chrome Extension, which could lead to unauthorized data access or modification within the browser environment. There are no reports of active exploitation in the wild. The severity is considered medium by the Chromium security team.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html for current remediation guidance. Until official confirmation is available, users should update to Chrome version 148.0.7778.96 or later if possible, as the vulnerability affects versions prior to this. No additional vendor-provided mitigation instructions are currently available.