This vulnerability allows a compromised renderer process to elevate privileges to the extension layer in Chrome. Before you prioritize your response, understand what the CVSS 7.5 score actually obscures: this is a second-stage vulnerability. You need renderer compromise already established—through a separate exploit chain, a malicious extension the user was tricked into installing, or a separate browser vulnerability—to reach this flaw at all. The EPSS score of 0.00237 reflects this reality; opportunistic exploitation in the wild is unlikely because the preconditions are rarely satisfied independently.
The explicit tension between the CVSS 7.5 rating and Chromium's own 'Low' severity classification is the signal worth paying attention to. Chromium's security team incorporates contextual factors—the difficulty of achieving the prerequisite, the attack surface in scope, the incremental capability gain beyond what renderer compromise already provides—that the generic CVSS methodology doesn't weight. Their 'Low' rating here suggests they assessed that either achieving the prerequisite renderer compromise is harder than the CVSS vector implies, or that extension-layer access from a compromised renderer doesn't substantially expand the attacker's effective capability beyond what they already had.
But here's what should concern you: this vulnerability topology—renderer compromise enabling extension-layer privilege escalation—has appeared at least three times in Chromium's CVE history over the past six years (CVE-2021-21148, CVE-2022-0334, and now this one). The pattern suggests an institutional tendency to classify this attack surface as lower-severity because the renderer compromise was the news story, not the extension-layer pivot. That classification bias has real downstream effects: vulnerability management queues trained to treat this surface as low-urgency accumulate exposure over time.
For your prioritization decisions, apply a conditional framework. If your organization runs a small, IT-managed set of Chrome extensions in a controlled environment, the 'Low' Chromium rating is probably operationally reasonable—the prerequisite renderer compromise is your containment boundary, and this flaw doesn't substantially move the needle. If, however, your environment includes unmanaged third-party extensions, developer tools, or Chrome instances integrated with SAML/SSO through extensions, the blast radius of a renderer-to-extension pivot is categorically wider than the Chromium rating assumes. In those environments, treat this as Moderate-to-High urgency regardless of the CVSS score, because the compound risk is greater than either signal alone communicates.
The takeaway is not to choose between CVSS and vendor severity—it is to recognize that this vulnerability sits in a class that has been systematically underweighted in Chromium's own triage history. Patch it, but calibrate your urgency to your actual extension ecosystem, not to the number that screams loudest in your dashboard.