Google Chrome contains a high-severity security flaw due to missing authorization in its extension architecture that enables remote information disclosure.

This vulnerability, categorized as CWE-862 (Missing Authorization), occurs within the Chrome Extensions component. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms that the flaw is exploitable by an unauthenticated remote attacker without requiring user interaction.

The ability for an unauthenticated attacker to remotely exfiltrate sensitive data presents a significant risk to user privacy and organizational confidentiality. Although the CVSS score is 7.5, which falls in the High range, the potential for unauthorized data access could lead to severe regulatory non-compliance and loss of intellectual property if leveraged against high-value targets.

Immediate Action: Update all instances of Google Chrome to version 153.0.8010.36 or later to apply the necessary authorization checks.

Proactive Monitoring: Review browser extension deployment policies and monitor for unusual network activity originating from browser-based processes that might indicate data exfiltration.

Compensating Controls: Implement organizational policies that restrict the installation of third-party extensions via Group Policy or MDM solutions until systems are patched.

Public Exploit Available: No (exploit_available: false)

Given the remote, unauthenticated nature of this vulnerability, immediate patching is required to prevent potential information disclosure. Administrators should prioritize the deployment of the Chrome update across the enterprise to ensure that the extension authorization mechanism is correctly enforced.