This vulnerability arises from insufficient enforcement of policies within Chrome's DevTools, enabling a malicious extension to bypass cross-origin restrictions and leak data from other origins. The issue affects Chrome versions before 148.0.7778.96. Exploitation requires user interaction to install a crafted malicious extension. The Chromium project rates this security issue as low severity, indicating limited impact or exploitability.

An attacker who successfully convinces a user to install a malicious Chrome extension could leak cross-origin data, potentially exposing sensitive information from other web origins accessible in the browser context. However, the impact is limited by the need for user installation of the malicious extension and the low severity rating.

Patch status is not yet confirmed—check the vendor advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html for current remediation guidance. Users and administrators should ensure Chrome is updated to version 148.0.7778.96 or later once available. Until then, avoid installing untrusted extensions and follow best practices for extension management.